A critical authentication vulnerability in vLLM before version 0.11.0rc2 allows remote, unauthenticated attackers to bypass API key security via timing-based side-channel analysis.

The vulnerability exists in the API key validation logic, which utilizes a non constant time string comparison. This flaw allows an unauthenticated attacker to observe response time variations to iteratively guess valid API keys.

The exploitation of this vulnerability directly undermines the authentication mechanism of the vLLM inference engine. Successful unauthorized access could lead to the exposure of sensitive model data, unauthorized use of expensive compute resources, or potential manipulation of model inputs, resulting in significant operational and security risks. With a CVSS score of 7.5, this high-severity flaw requires immediate remediation to prevent unauthorized system access.

Immediate Action: Update the vLLM installation to version 0.11.0 or later to implement constant-time string comparison for API key validation.

Proactive Monitoring: Monitor API server access logs for anomalous patterns of high-frequency requests targeting the authentication endpoint, which may indicate an ongoing timing attack.

Compensating Controls: Deploy a Web Application Firewall (WAF) or API gateway to implement rate limiting on authentication requests, which increases the difficulty of performing the necessary volume of requests for a timing attack.

Public Exploit Available: Unknown.

Given the ease with which this vulnerability can be exploited by an unauthenticated attacker, organizations must prioritize patching their vLLM deployments. Updating to version 0.11.0 effectively mitigates the risk by introducing secure comparison methods. Organizations unable to update immediately should implement strict rate limiting and monitor for suspicious authentication traffic to reduce the likelihood of successful exploitation.