CVE-2026-22807
published 2026-01-21CVE-2026-22807: vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face…
PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.74%
52.3th percentile
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaii | vllm-neuron-rhel9 | — | — |
| rhaii | vllm-tpu-rhel9 | — | — |
| rhaiis | vllm-cpu-rhel9 | — | — |
| rhaiis | vllm-cuda-rhel9 | — | — |
| rhaiis | vllm-neuron-rhel9 | — | — |
| rhaiis | vllm-rocm-rhel9 | — | — |
| rhaiis | vllm-spyre-rhel9 | — | — |
| rhaiis | vllm-tpu-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhoai | odh-vllm-gaudi-rhel9 | — | — |
| vllm-project | vllm | — | — |
| vllm | vllm | >= 0.10.1 < 0.14.0 | 0.14.0 |
| vllm | vllm | >= 0.10.1 < 0.14.0 | 0.14.0 |
| vllm | vllm | >= 0.10.1 < 0.18.0 | 0.18.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Flag vLLM server startup events where `auto_map` dynamic modules are loaded from a model repo/path without `trust_remote_code` being explicitly enabled — this indicates the ungated code execution path described in CVE-2026-22807. ↗
- →Alert on vLLM processes loading NemotronVL or KimiK25 models, as these model implementation files hardcode `trust_remote_code=True`, bypassing user-configured `--trust-remote-code=False`. ↗
- →Detect arbitrary code execution occurring before any API request handling during vLLM model load phase — exploitation does not require API access and triggers at server startup. ↗
- →Monitor for vLLM instances running versions 0.10.1 through 0.13.x loading models from remote Hugging Face repositories or attacker-influenced local directory paths. ↗
- ·The `--trust-remote-code=False` flag is ineffective for NemotronVL and KimiK25 models in vLLM 0.14.1, as `trust_remote_code=True` is hardcoded in their model implementation files, making user-configured security settings non-operative for these model types. ↗
- ·CVE-2026-22807 is fixed in vLLM 0.14.0, but the related incomplete fix (CVE-2026-4944) affects vLLM 0.14.1 via separate hardcoded code paths — upgrading to 0.14.0 alone does not fully remediate the attack surface. ↗
- ·vLLM's `auto_map` module loading during model resolution is the ungated code execution trigger — any deployment where the model repo/path can be influenced by an external party is at risk regardless of API access controls. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa8.8HIGH
osv8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g57c-wgqx-8wx7: vllm-project/vllm version 0
ghsa_unreviewed·2026-05-28·CVSS 8.8
CVE-2026-4944 [HIGH] CWE-22 GHSA-g57c-wgqx-8wx7: vllm-project/vllm version 0
vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`vllm/model_executor/models/nemotron_vl.py` and `vllm/model_executor/models/kimi_k25.py`). This bypasses the user's explicit `--trust-remote-code=False` setting, enabling remote code execution via malicious HuggingFace model repositories. This issue is an incomplete fix for CVE-2025-66448 and CVE-2026-22807, as it affects separate code paths in model implementation files. Deployments loading NemotronVL or KimiK25 models are particularly impacted.
OSV
vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
osv·2026-03-27·CVSS 8.8
CVE-2026-27893 [HIGH] vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
### Summary
Two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model
repositories even when the user has explicitly disabled remote code trust.
### Details
**Affected files (latest main branch):**
1. `vllm/model_executor/models/nemotron_vl.py:430`
```python
vision_model = AutoModel.from_config(config.vision_config, trust_remote_code=True)
```
2. vllm/model_executor/models/kimi_k25.py:177
```python
cached_get_image_processor(self.ctx.model_config.model, trust_remote_code=True)
```
Both pass a hardcoded trust_remote_code=True to
GHSA
vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
ghsa·2026-03-27·CVSS 8.8
CVE-2026-27893 [HIGH] CWE-693 vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
### Summary
Two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model
repositories even when the user has explicitly disabled remote code trust.
### Details
**Affected files (latest main branch):**
1. `vllm/model_executor/models/nemotron_vl.py:430`
```python
vision_model = AutoModel.from_config(config.vision_config, trust_remote_code=True)
```
2. vllm/model_executor/models/kimi_k25.py:177
```python
cached_get_image_processor(self.ctx.model_config.model, trust_remote_code=True)
```
Both pass a hardcoded trust_remote_code=True to
GHSA
vLLM affected by RCE via auto_map dynamic module loading during model initialization
ghsa·2026-01-21
CVE-2026-22807 [HIGH] CWE-94 vLLM affected by RCE via auto_map dynamic module loading during model initialization
vLLM affected by RCE via auto_map dynamic module loading during model initialization
# Summary
vLLM loads Hugging Face `auto_map` dynamic modules during model resolution **without gating on `trust_remote_code`**, allowing attacker-controlled Python code in a model repo/path to execute at server startup.
---
# Impact
An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve **arbitrary code execution** on the vLLM host during model load.
This happens **before any request handling** and does **not require API access**.
---
# Affected Versions
All versions where `vllm/model_executor/models/registry.py` resolves `auto_map` entries with `try_get_class_from_dynamic_module` **without checking `trust_remote_code`** (at least current `main`)
OSV
vLLM affected by RCE via auto_map dynamic module loading during model initialization
osv·2026-01-21
CVE-2026-22807 [HIGH] vLLM affected by RCE via auto_map dynamic module loading during model initialization
vLLM affected by RCE via auto_map dynamic module loading during model initialization
# Summary
vLLM loads Hugging Face `auto_map` dynamic modules during model resolution **without gating on `trust_remote_code`**, allowing attacker-controlled Python code in a model repo/path to execute at server startup.
---
# Impact
An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve **arbitrary code execution** on the vLLM host during model load.
This happens **before any request handling** and does **not require API access**.
---
# Affected Versions
All versions where `vllm/model_executor/models/registry.py` resolves `auto_map` entries with `try_get_class_from_dynamic_module` **without checking `trust_remote_code`** (at least current `main`)
Red Hat
vllm: vllm-project/vllm: Remote Code Execution via malicious HuggingFace model repositories
vendor_redhat·2026-05-28·CVSS 8.8
CVE-2026-4944 [HIGH] CWE-547 vllm: vllm-project/vllm: Remote Code Execution via malicious HuggingFace model repositories
vllm: vllm-project/vllm: Remote Code Execution via malicious HuggingFace model repositories
vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`vllm/model_executor/models/nemotron_vl.py` and `vllm/model_executor/models/kimi_k25.py`). This bypasses the user's explicit `--trust-remote-code=False` setting, enabling remote code execution via malicious HuggingFace model repositories. This issue is an incomplete fix for CVE-2025-66448 and CVE-2026-22807, as it affects separate code paths in model implementation files. Deployments loading NemotronVL or KimiK25 models are particularly impacted.
A flaw was found in vllm-project/vllm. A hardcoded setting in the model implementation files bypasses th
Red Hat
vLLM: vLLM: Arbitrary code execution via untrusted model loading
vendor_redhat·2026-01-21·CVSS 8.8
CVE-2026-22807 [HIGH] CWE-94 vLLM: vLLM: Arbitrary code execution via untrusted model loading
vLLM: vLLM: Arbitrary code execution via untrusted model loading
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability allows a re
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-22807 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-22807 [HIGH] CVE-2026-22807 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-22807 :
Chainguard vulnerability analysis and mitigation
auto_map
trust_remote_code
Source : NVD
## 9.8
Score
Published January 21, 2026
Severity CRITICAL
CNA Score 8.8
Affected Technologies
Chainguard
vLLM
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
py3-vllm-cuda-12.4
tritonserver-backend-vllm-cuda-13.0
Sources
NVD
Chainguard Has Fix Added at: Jan 23, 2026
pip Severity HIGH Has Fix Added at: Jan 22, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related Chainguard vulnerabilities:
C
Bugzilla
CVE-2026-4944 vllm: vllm-project/vllm: Remote Code Execution via malicious HuggingFace model repositories
bugzilla·2026-05-28·CVSS 8.8
CVE-2026-4944 [HIGH] CVE-2026-4944 vllm: vllm-project/vllm: Remote Code Execution via malicious HuggingFace model repositories
CVE-2026-4944 vllm: vllm-project/vllm: Remote Code Execution via malicious HuggingFace model repositories
vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`vllm/model_executor/models/nemotron_vl.py` and `vllm/model_executor/models/kimi_k25.py`). This bypasses the user's explicit `--trust-remote-code=False` setting, enabling remote code execution via malicious HuggingFace model repositories. This issue is an incomplete fix for CVE-2025-66448 and CVE-2026-22807, as it affects separate code paths in model implementation files. Deployments loading NemotronVL or KimiK25 models are particularly impacted.
https://github.com/vllm-project/vllm/commit/78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5https://github.com/vllm-project/vllm/pull/32194https://github.com/vllm-project/vllm/releases/tag/v0.14.0https://github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmrhttps://access.redhat.com/errata/RHSA-2026:10184https://access.redhat.com/errata/RHSA-2026:30087https://access.redhat.com/errata/RHSA-2026:30088https://access.redhat.com/errata/RHSA-2026:30089https://access.redhat.com/errata/RHSA-2026:3461https://access.redhat.com/errata/RHSA-2026:3462https://access.redhat.com/errata/RHSA-2026:3713https://access.redhat.com/errata/RHSA-2026:3782https://access.redhat.com/errata/RHSA-2026:42644https://access.redhat.com/errata/RHSA-2026:5119https://access.redhat.com/security/cve/CVE-2026-22807https://bugzilla.redhat.com/show_bug.cgi?id=2431865https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22807.json
2026-01-21
Published