vLLM browser origins could access an unauthenticated loopback inference server

An AI model server that advertised permissive CORS to any browser origin and accepted requests without an API key could be invoked from an attacker-controlled web page.

The vulnerable configuration requires reachable loopback or private-network serving without separate token authentication; hosts with mandatory API keys are different. JavaScript on an unrelated website could list available models or consume local inference resources through the user’s browser.

The advisory demonstrates browser-origin access under specific defaults, not a general remote internet takeover or stolen customer model data. Use vLLM 0.32.0 and restrict allowed origins while enforcing API credentials for reachable private inference services.

Evidence interpretation and control boundary. The browser origin is an external principal even when the inference service listens only on a developer’s loopback address. The weakness combines a wildcard Access-Control-Allow-Origin response with unauthenticated serving; CORS by itself is not a server authentication system, and hosts requiring an API key have different exposure. The reported effect is cross-origin inference requests and resource consumption, not a demonstrated theft of model weights.