CVE-2026-48746

vLLM Inference Server Authentication Bypass Flaw CVE-2026-48746 Exposes Enterprise Model Endpoints Without API Keys

Critical CVSS 9.1 flaw CVE-2026-48746 in vLLM allows unauthenticated remote attackers to bypass API key verification and access model completions due to URL normalization defects.