---
title: "Discussion on \"vLLM CORS Vulnerability: The API Key Never Covered /invocations\" | Hashnode"
description: "Discussion on \"vLLM CORS Vulnerability: The API Key Never Covered /invocations\". vLLM before 0.32.0 let any web page read model output via the browser, even with --api-key set. Checks and fixes for CVE-2026-115917."
url: "https://hashnode.com/posts/vllm-cors-vulnerability-cve-2026-115917/6aec14525705da2d5d900a6c"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [vLLM CORS Vulnerability: The API Key Never Covered /invocations](https://404-founders.com/blog/vllm-cors-vulnerability-cve-2026-115917?utm_source=hashnode&utm_medium=feed)

vLLM before 0.32.0 let any web page read model output via the browser, even with --api-key set. Checks and fixes for CVE-2026-115917.

6d ago · 15 min read · 404-founders.com  
Read the article

-   [#ai-security](https://hashnode.com/tag/ai-security)
-   [#vllm](https://hashnode.com/tag/vllm)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)

## Written by

[404 Founders](https://hashnode.com/@404-founders)

@404-founders · Bosnia and Herzegovina, Estonia

  
[View profile](https://hashnode.com/@404-founders)

Error-proof Cyber Solutions

Securing the digital frontier. Error-proof cyber solutions.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.