CVE-2026-41523
published 2026-06-22CVE-2026-41523: vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading…
PriorityP352high7.5CVSS 3.1
AVNACHPRNUIRSUCHIHAH
EPSS
0.46%
36.7th percentile
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaii | vllm-rocm-rhel9 | — | — |
| rhaii | vllm-spyre-rhel9 | — | — |
| rhelai3 | bootc-aws-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-rocm-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-gcp-cuda-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhoai | odh-vllm-gaudi-rhel9 | — | — |
| vllm-project | vllm | < 0.22.0 | 0.22.0 |
| vllm | vllm | < 0.22.0 | 0.22.0 |
| vllm | vllm | >= 0 < 0.22.0 | 0.22.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
ghsa·2026-06-16
CVE-2026-41523 [HIGH] CWE-617 vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
### Summary
An `assert`-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (`python -O` or `PYTHONOPTIMIZE=1`).
### Details
vLLM uses an `assert` statement at [`vllm/model_executor/layers/pooler/activations.py:48`](https://github.com/vllm-project/vllm/blob/main/vllm/model_executor/layers/pooler/activations.py#L48) as its sole security control to restrict which activation functions can be loaded from a HuggingFace model's `config.json`:
```python
# vllm/model_executor/layers/pooler/activations.py:35-
Red Hat
vllm: vLLM: Arbitrary code execution via malicious HuggingFace model
vendor_redhat·2026-06-22·CVSS 7.5
CVE-2026-41523 [HIGH] CWE-617 vllm: vLLM: Arbitrary code execution via malicious HuggingFace model
vllm: vLLM: Arbitrary code execution via malicious HuggingFace model
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0.
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in P
No detection rules found.
No public exploits indexed.
https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3rhttps://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64chttps://access.redhat.com/security/cve/CVE-2026-41523https://bugzilla.redhat.com/show_bug.cgi?id=2491582https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41523.json
2026-06-22
Published