CVE-2026-48746
Full vulnerability record from the local CVENow database.
Description
vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.
Severity
CRITICAL
CVSS score
9.1
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-06-22 23:16:30.490000
Last modified
2026-10-25 23:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-48746",
"sourceIdentifier": "[email protected]",
"published": "2026-06-22T23:16:30.490",
"lastModified": "2026-10-25T23:10:00.167",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0."
},
{
"lang": "es",
"value": "vLLM es un motor de inferencia y servicio para modelos de lenguaje grandes (LLM). Desde la versión 0.3.0 hasta la 0.22.0, una vulnerabilidad en los servidores web ASGI y la confianza de Starlette en esos servidores web permite una omisión de autenticación del middleware de autenticación de la API de OpenAI. Permite usar la API sin proporcionar la VLLM_API_KEY o --api-key configurada. Esta vulnerabilidad está corregida en la versión 0.22.0."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "vllm-project",
"product": "vllm",
"versions": [
{
"version": ">= 0.3.0, < 0.22.0",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server 3.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhaiis/vllm-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.2::el9"
],
"versions": [
{
"version": "1782951012",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
},
{
"version": "1787860580",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server 3.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhaiis/vllm-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.2::el9"
],
"versions": [
{
"version": "1782951244",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
},
{
"version": "1787884873",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server 3.3",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhaiis/vllm-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"versions": [
{
"version": "1782353093",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server 3.3",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhaiis/vllm-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"versions": [
{
"version": "1782352847",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "ansible-automation-platform-26/mcp-tools-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"versions": [
{
"version": "1783920640",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2.7",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "ansible-automation-platform-27/mcp-tools-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.7::el9"
],
"versions": [
{
"version": "1783918403",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Migration Toolkit for Applications 8.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "mta/mta-solution-server-rhel9",
"cpes": [
"cpe:/a:redhat:migration_toolkit_applications:8.2::el9"
],
"versions": [
{
"version": "1784109883",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 2.25",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-caikit-tgis-serving-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"versions": [
{
"version": "1783082430",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Exploit Intelligence",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9",
"cpes": [
"cpe:/a:redhat:exploit_intelligence:0"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Lightspeed",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-lightspeed/lightspeed-agentic-sandbox-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Lightspeed",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-lightspeed/lightspeed-ocp-rag-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Lightspeed",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-lightspeed/lightspeed-service-api-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-cpu-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-neuron-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-spyre-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-tpu-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaii/vllm-cpu-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaii/vllm-gaudi-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaii/vllm-neuron-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaii/vllm-spyre-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaii/vllm-tpu-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/lightspeed-chatbot-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/lightspeed-chatbot-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/lightspeed-chatbot-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-aws-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-azure-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-azure-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-gaudi-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-gcp-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/disk-image-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "jaeger",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-automl-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-built-in-detector-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-caikit-nlp-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-feature-server-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-guardrails-detector-huggingface-runtime-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-kserve-agent-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-kserve-autogluon-server-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-kserve-controller-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-kserve-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-kserve-storage-initializer-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-llama-stack-core-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-llm-d-kv-cache-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-mlflow-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-mlserver-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-training-cuda128-torch29-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-trustyai-nemo-guardrails-server-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-vllm-gaudi-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Satellite 6",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "satellite/foreman-mcp-server-rhel9",
"cpes": [
"cpe:/a:redhat:satellite:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Satellite 6",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "satellite/iop-advisor-engine-rhel9",
"cpes": [
"cpe:/a:redhat:satellite:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Satellite 6",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "satellite/iop-host-inventory-rhel9",
"cpes": [
"cpe:/a:redhat:satellite:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Satellite 6",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "satellite/iop-vmaas-rhel9",
"cpes": [
"cpe:/a:redhat:satellite:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Satellite 6",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "satellite/iop-vulnerability-engine-rhel9",
"cpes": [
"cpe:/a:redhat:satellite:6"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-23T14:01:22.798843Z",
"id": "CVE-2026-48746",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-444"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-501"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.3.0",
"versionEndExcluding": "0.22.0",
"matchCriteriaId": "0D7B8DAA-6987-468A-9721-05A123DB61E3"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/vllm-project/vllm/pull/43426",
"source": "[email protected]",
"tags": [
"Issue Tracking"
]
},
{
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://x41-dsec.de/lab/advisories/x41-2026-002-starlette",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30088",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30089",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36005",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36006",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:42132",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:42142",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:42644",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:43038",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:61627",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:61629",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-48746",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491581",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48746.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://x41-dsec.de/lab/advisories/x41-2026-002-starlette",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Third Party Advisory"
]
}
]
}