{"action":"Upgrade vllm to 0.22.0 or later.","affected":[{"fixed":"0.22.0","introduced":"0.3.0"}],"component":"vllm","cve_ids":["CVE-2026-48746"],"ecosystem":"PyPI","epss":0.01152,"exploited":false,"fixed_versions":["0.22.0"],"ghsa_id":"GHSA-94f4-hr76-p5j6","id":"tcs_01M5KF9Q0W6RCBAV2DM49EAH30","modified_at":"2026-09-10T03:50:49.016998148Z","published_at":"2026-06-16T17:36:41Z","references":["https://osv.dev/vulnerability/GHSA-94f4-hr76-p5j6","https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6","https://nvd.nist.gov/vuln/detail/CVE-2026-48746","https://github.com/vllm-project/vllm/pull/43426","https://x41-dsec.de/lab/advisories/x41-2026-002-starlette","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48746.json","https://github.com/vllm-project/vllm","https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-226.yaml","https://bugzilla.redhat.com/show_bug.cgi?id=2491581","https://access.redhat.com/security/cve/CVE-2026-48746","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30088"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-94f4-hr76-p5j6","url":"https://osv.dev/vulnerability/GHSA-94f4-hr76-p5j6"}],"summary":"vLLM: OpenAI auth bypass"}