vLLM affected by RCE via auto_map dynamic module loading during model initialization
Priority MEDIUM 45CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 5 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.
Summary
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0098 62nd percentileScored 2026-11-07
Fix Partial vllm (vllm-project): 0.14.0vllm (PyPI): 0.14.0Red Hat: 10 advisoriesRed Hat: 5 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vllm-project | vllm | 0.10.1 to before 0.14.0 | 0.14.0 | Patch available | CNA |
| — | vllm (PyPI) | 0.10.1 to before 0.14.0 | 0.14.0 | Patch available | GHSA-2pc9-4j83-qjmr |
- vllm Vendorvllm-project Affected 0.10.1 to before 0.14.0 Fixed in 0.14.0 Patch available CNA
- vllm (PyPI) Vendor— Affected 0.10.1 to before 0.14.0 Fixed in 0.14.0 Patch available GHSA-2pc9-4j83-qjmr
Remediation
- Fix · CNA vllm (vllm-project) Fixed in 0.14.0
- Fix · GHSA-2pc9-4j83-qjmr vllm (PyPI) Fixed in 0.14.0 Advisory →
Red Hat 10 advisories
- RHSA-2026:42644 Released 2026-07-21 · Red Hat rating ImportantRHOAI 2.25.9 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9 +36
- RHSA-2026:30089 Released 2026-06-25 · Red Hat rating CriticalRed Hat AI Inference Server 3.3.5 (CUDA)
- Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
- RHSA-2026:30088 Released 2026-06-25 · Red Hat rating CriticalRed Hat AI Inference Server 3.3.5 (ROCm)
- Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
Show 7 more Red Hat advisories
- RHSA-2026:30087 Released 2026-06-25 · Red Hat rating CriticalRed Hat AI Inference Server 3.3.5 (Spyre)
- Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
- RHSA-2026:10184 Released 2026-04-23 · Red Hat rating ImportantRHOAI 2.25.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:5119 Released 2026-03-19 · Red Hat rating ImportantRed Hat OpenShift AI 3.4.0-ea.1 Release
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9
- RHSA-2026:3782 Released 2026-03-04 · Red Hat rating CriticalRHOAI 2.25.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +27
- RHSA-2026:3713 Released 2026-03-04 · Red Hat rating CriticalRHOAI 3.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:3462 Released 2026-02-27 · Red Hat rating CriticalRed Hat AI Inference Server 3.2.2 (ROCm)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
- RHSA-2026:3461 Released 2026-02-27 · Red Hat rating CriticalRed Hat AI Inference Server 3.2.2 (CUDA)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AI Inference Server | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat AI Inference Server 3.2 | Fixed | RHSA-2026:3461, RHSA-2026:3462 |
| Red Hat AI Inference Server 3.3 | Fixed | RHSA-2026:30087, RHSA-2026:30088, RHSA-2026:30089 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:10184, RHSA-2026:3782, RHSA-2026:42644 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:3713 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:5119 |
Not affected: 4 products
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift AI 3.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-22807
- 2026-10-03 Alias added: GHSA-2pc9-4j83-qjmr
- 2026-11-06 Fix available: RHSA-2026:42644 · Red Hat
References
Patch 3
Advisory 2
Other 17
- https://github.com/vllm-project/vllm/releases/tag/v0.14.0
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22807.json
- https://pypi.org/project/vllm
- https://github.com/vllm-project/vllm
- https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2010.yaml
- https://bugzilla.redhat.com/show_bug.cgi?id=2431865
- https://access.redhat.com/security/cve/CVE-2026-22807
- https://access.redhat.com/errata/RHSA-2026:5119
- https://access.redhat.com/errata/RHSA-2026:42644
- https://access.redhat.com/errata/RHSA-2026:3782
- https://access.redhat.com/errata/RHSA-2026:3713
- https://access.redhat.com/errata/RHSA-2026:3462
- https://access.redhat.com/errata/RHSA-2026:3461
- https://access.redhat.com/errata/RHSA-2026:30089
- https://access.redhat.com/errata/RHSA-2026:30088
- https://access.redhat.com/errata/RHSA-2026:30087
- https://access.redhat.com/errata/RHSA-2026:10184
More vllm-project vulnerabilities
- TI-2024-10229 Remote Code Execution in vllm-project/vllm CVSS 3.0CRITICAL 9.8
- TI-2024-08404 Remote Code Execution in vllm-project/vllm CVSS 3.1CRITICAL 9.8
- TI-2026-36017 vLLM: OpenAI auth bypass CVSS 3.1CRITICAL 9.1
- TI-2026-63056 vLLM before 0.28.0 Denial of Service via negative token ID CVSS 4.0HIGH 8.7
- TI-2026-04308 Hardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control CVSS 3.0HIGH 8.8
- TI-2026-39137 vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection CVSS 3.1HIGH 7.5
Sources
- CVE-2026-22807 · CVE Program
- CVE-2026-22807 · NVD
- FIRST EPSS
- GHSA-2pc9-4j83-qjmr · GitHub Advisory Database · CC BY 4.0
- CVE-2026-22807 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences