Tools AI Risk Radar ai-incident-0243
Incident record
vLLM default browser policy allowed cross-origin access
- Severity
- Low
- Status
- Patched
- Type
- Infra Vuln
- Target
- vllm-project/vllm
- Actor
- researcher
What happened
A web page could make requests to an unauthenticated vLLM server reachable from the visitor’s browser and read the responses.
The maintainer rates this Low and lists 0.32.0 as patched. Operators should configure authentication and allowed origins. A caller that already possesses a configured bearer token has a different access position from a page with no token.
Sources
- Maintainer security advisorygithub.com/vllm-project/vllm/security/advisories/GHSA-vvpg-r…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 20 October 2026