What happened
vLLM configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default, so a malicious web page can reach an unauthenticated vLLM server on localhost via the victim's browser. CVSS 3.4 (browser-origin attack).
Why it matters
This turns a localhost vLLM dev/preview server into a victim-driven endpoint: a malicious page can silently drive the browser to consume or abuse the LLM serving API, which matters where developers preview an engine that later holds real API keys or model context.
Attack vector
The server sets allowed_origins to a wildcard by default, so a malicious page can use a victim's browser to make cross-origin requests to an unauthenticated vLLM instance (e.g. a local/dev server) and run inference or enumerate/abuse the endpoint using the victim's session context.
Affected systems
vLLM prior to 0.32.0 (OpenAI-compatible server, Starlette CORSMiddleware default wildcard).
Mitigation
Upgrade to vLLM 0.32.0 (fix in commit fcae5c98) which restricts CORS allowed_origins; or configure TLS + a non-wildcard allowed origin list.