BuildNot yet confirmed elsewhere1 publisher3 min readPublished
A vLLM server with --api-key set still lets anyone who reaches port 8000 pause it
vLLM's --api-key guards four path prefixes, so /invocations, /tokenize and /pause answer without a key. The server also binds every interface by default, so a dev.to walkthrough puts it on localhost behind an allowlist proxy.
The Engineer · Build desk
The vLLM security guide lists 11 routes as open without a key. 4 of them are /pause, /resume, /abort_requests and /update_weights. 6 are /pooling, /classify, /score, /rerank, /tokenize and /detokenize. 1 is /invocations.
- Pause, resume, abort, weights, claim 22 4 of 11 routes 36% computed
Pause, resume, abort, weights The rest of the 11
- Pooling, score, token routes, claim 22 6 of 11 routes 55% computed
Pooling, score, token routes The rest of the 11
- /invocations, claim 22 1 of 11 routes 9.1% computed
/invocations The rest of the 11
| Share | Part | Whole | Percent | Claim |
|---|---|---|---|---|
| Pause, resume, abort, weights | 4 routes | 11 routes | 36% (computed) | 22 |
| Pooling, score, token routes | 6 routes | 11 routes | 55% (computed) | 22 |
| /invocations | 1 routes | 11 routes | 9.1% (computed) | 22 |
What happened
- The guide lists 11 routes as open without a key, among them /pooling, /score, /detokenize, /resume, /abort_requests and /update_weights.
- Setting VLLM_SERVER_DEV_MODE=1 adds a /collective_rpc route that the guide calls "extremely dangerous".
- The guide calls a reverse proxy that allowlists endpoints "the most effective approach", and the post supplies Caddy and nginx versions.
- The post counts 30+ vLLM advisories since 12 September, most without a CVE ID, and says 0.31.0 fixes all of them.
Why it matters
- exposure On a default launch, anyone who can reach port 8000 can run prompts on the GPU, pause the server or cancel other users' requests, with or without a key.
- cost The proxy passes only four paths. A client or scraper that uses any other route, /metrics included, gets a 404 until someone edits the list.
- decision Docker users have to pick the publish form: 127.0.0.1:8000:8000, or no ports on the vLLM service. A host firewall will not do it, because Linux Docker ports skip ufw and firewalld.
- constraint The proxy forwards X-Request-Id, so on P2pNcclConnector 0.9.2 to 0.23.x a keyholder can still reach the KV-cache leak in GHSA-vfp2-c8pq-v6h6 until vLLM is upgraded.
The guide's wording on scope is short. It says the key is checked only on endpoints under four path prefixes: /v1, /v2, /inference and /cohere [1]. It adds that "many other sensitive endpoints are exposed on the same HTTP server without any authentication enforcement" [2]. The sharp case is /invocations. It runs the same inference as /v1, so one route sits behind the key and its twin does not [4]. The guide's advice is "Do not rely exclusively on --api-key for securing access to vLLM" [3].
The default comes down to one expression in the launcher: (args.host or "", args.port). An empty string means all interfaces [5]. The post's fix therefore starts with --host 127.0.0.1, and the key goes in VLLM_API_KEY [9]. Unlike --api-key, the variable doesn't put the key in the process list, where any user of the machine could read it [10]. The post says to keep it set behind the proxy too, so a proxy mistake doesn't open /v1 [11].
The proxy config is the good part. In Caddy, different matcher types inside one named matcher must all match, so the keyed block needs both an allowed path and the exact Authorization header [15]. Blocks with named matchers run in the order written, and only the first match fires. The block with no matcher runs last and answers 404 [15]. Because path is an exact match, /invocations, /tokenize, /pause and /metrics all get 404 [16]. We think that default-deny shape is right: a route added in a later vLLM release stays closed until someone lists it [23]. The nginx version does the same with a regex location and a catch-all 404 [21].
Both examples compare the Authorization header against a literal Bearer string pasted into the proxy config [17]. The key therefore lives in two places, the vLLM environment and the proxy, and a rotation touches both [24].
Verification is one command. From a different machine, curl vLLM's port directly. The post says it should fail to connect [18]. If it answers, the post points to --host, the Docker ports and `ss -tlnp | grep 8000` [18].
Multi-node traffic is a separate surface. The guide calls it "insecure by default," and PyTorch's TCPStore listens on all interfaces [25]. The post's answer is an isolated network with VLLM_HOST_IP set to the private address [25].
One note on sourcing. Everything here comes from a single dev.to post, whose author describes itself as an AI made by Munim, Inc. It says it checked the text against at least vLLM's security guide, CLI reference and Docker guide [19]. It also links a free advisory checker that runs in the browser [20]. The quoted guide lines are as the post reproduces them.
What to watch
- Whether vLLM changes the default bind from all interfaces to localhost, or extends --api-key to routes outside the four prefixes.
- Whether the 30+ advisories the post counts since 12 September get CVE IDs and OSV entries, since the post says most have neither.
- Whether vLLM's own guide confirms the 11-route open list and the 0.31.0 fix claim, which here rest on one post.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap−5
- Incentives30
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
vLLM's security guide says the API key is checked "only for endpoints under the /v1, /v2, /inference, and /cohere path prefixes".
- [2]
The guide says "many other sensitive endpoints are exposed on the same HTTP server without any authentication enforcement."
- [3]
The guide's advice is: "Do not rely exclusively on --api-key for securing access to vLLM."
- [4]
The guide lists these routes as open without a key: /invocations (the same inference as /v1); /pooling, /classify, /score, /rerank, /tokenize, /detokenize; and /pause, /resume, /abort_requests, /update_weights.
ReportedSupportedSource: vLLM security guide, as summarised in the dev.to post by MV2View cited source - [5]
vllm serve listens on every interface unless --host is passed: the launcher binds (args.host or "", args.port), and an empty string means all interfaces.
- [6]
Docker's -p 8000:8000 publishes the port on all host interfaces in the same way.
- [7]
Anyone who can reach port 8000 can run prompts on the GPU, pause the server or cancel other users' requests, key or no key.
- [8]
The guide calls a reverse proxy that allowlists endpoints "the most effective approach".
- [9]
The post's setup exports VLLM_API_KEY with a random value and starts vllm serve with --host 127.0.0.1 --port 8000 --disable-fastapi-docs.
- [10]
VLLM_API_KEY keeps the key out of the process list, where --api-key would show it to every user on the machine.
- [11]
The post says to keep the key set even behind the proxy, so a proxy mistake doesn't open /v1.
- [12]
Setting VLLM_SERVER_DEV_MODE=1 adds a /collective_rpc route that the guide calls "extremely dangerous"; the post says never to set it on a reachable server.
- [13]
With Docker, the post says to publish with -p 127.0.0.1:8000:8000, or give the vLLM service no ports and publish only the proxy. On Linux, ports Docker publishes skip ufw and firewalld.
- [14]
The Caddy example allowlists four paths: /v1/chat/completions, /v1/completions, /v1/embeddings and /v1/models.
- [15]
In Caddy, different matcher types inside one named matcher must all match, so the keyed matcher needs an allowed path and the exact Authorization header. Handle blocks with named matchers run in the order written, first match only; the block without a matcher runs last and responds 404.
- [16]
Because Caddy's path matcher is an exact match, /invocations, /tokenize, /pause and /metrics all get 404 through the example proxy.
- [17]
Both the Caddy and nginx examples compare the Authorization header against a literal Bearer value pasted into the proxy config.
- [18]
To verify, curl http://<server LAN IP>:8000/version from another machine straight to vLLM; it should fail to connect. If it answers, check --host, Docker ports: and ss -tlnp | grep 8000.
- [19]
The post's author identifies itself as MV2, an AI made by Munim, Inc., and says it checked the post against vLLM's security guide, CLI reference, Docker guide and further documents (the source text is cut off after "launch").
- [20]
The post points readers to a free advisory checker that runs in the browser to see which advisories affect their vLLM version.
- [21]
The nginx example uses a regex location for the same four /v1 paths, a map on $http_authorization for the key check, and a catch-all location / that returns 404.
- [22]
The guide lists 11 routes as open without a key: 1 (/invocations) + 6 (/pooling, /classify, /score, /rerank, /tokenize, /detokenize) + 4 (/pause, /resume, /abort_requests, /update_weights).
- [23]
Through the example proxy, only the four allowlisted paths reach vLLM; any other route, /metrics included, returns 404, so a route added in a later vLLM release stays closed until someone adds it to the list.
- [24]
The key is held in two places, the vLLM process environment and the proxy config, so rotating it means changing both.
- [25]
The guide says traffic between nodes (PyTorch distributed, KV-cache transfer, parallelism) is "insecure by default", and PyTorch's TCPStore listens on all interfaces. The post says to keep multi-node setups on an isolated network and set VLLM_HOST_IP to the private address.
- [26]
For disaggregated serving with P2pNcclConnector on vLLM 0.9.2 to 0.23.x, GHSA-vfp2-c8pq-v6h6 let an X-Request-Id header leak KV-cache data, and the post's proxy passes that header through.
- [27]
The post says anyone with the key still reaches the inference code that most of vLLM's 30+ advisories since 12 September are in, most with no CVE ID and not in OSV, and that vLLM 0.31.0 fixes all of them.
ReportedContestedSource: dev.to post by MV2 (single source for the advisory count and the 0.31.0 claim)View cited source
Sources
1 independent publisher whose own reporting we read for this story.
- dev.tovLLM's --api-key leaves /invocations, /tokenize and /pause open. Lock it down with an allowlist proxy
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.