gcdRadar
archive/Patch now/AIR-2026-1097
closedclosed 28 May 2026Patch now2 Disclosed vulnerabilityAI

vLLM Hardcoded Trust Remote Code Parameter Leads to RCE

vllm

Version 0.14.1 of vLLM contains a vulnerability where the trust_remote_code parameter is hardcoded for specific models, bypassing user configuration settings. This enables remote code execution through malicious HuggingFace model repositories.

disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why

CVSS
8.8
EPSS
0.01 · top 45% · 2026-11-13
EPSS scores by FIRST
fix status
Fix status unknown
first report
28 May 2026
last update
28 May 2026
CVE ids
CVE-2026-4944other records

Timeline · 1

  1. 28 May 2026CVE-2026-4944: vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model…

Sources · 1

Advisories and databases

  1. 2026-05-28
    CVE-2026-4944: vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model…
    NVD · nvd.nist.gov/vuln/detail/CVE-2026-4944

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane
Patch now
AI role
Attack on AI
categories
Infrastructure vulnerabilitySupply chain
severity
2 · Disclosed vulnerability
fix status
Fix status unknown
targets
Framework / tooling
owasp llm top 10
LLM03:2025 Supply Chain
mitre atlas
AML.T0010 AI Supply Chain Compromise
tags
rcesupply-chain
dates
happened 28 May 2026 · first reported 28 May 2026
origin
NVD
Vulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
record
confidence 0.95 · created 2026-10-18 10:04Z · updated 2026-10-18 10:04Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# vLLM Hardcoded Trust Remote Code Parameter Leads to RCE

https://gcdradar.vercel.app/incidents/vllm-hardcoded-trust-remote-code-parameter-leads-to-rce · AIR-2026-1097 · closed 2026-05-28

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-05-28
- AI role: Attack on AI
- Products: vllm
- CVE ids: CVE-2026-4944
- CVSS: 8.8

## Summary

Version 0.14.1 of vLLM contains a vulnerability where the trust_remote_code parameter is hardcoded for specific models, bypassing user configuration settings. This enables remote code execution through malicious HuggingFace model repositories.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-05-28: CVE-2026-4944: vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model… (https://nvd.nist.gov/vuln/detail/CVE-2026-4944)

## Sources

- 2026-05-28 NVD: CVE-2026-4944: vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model… https://nvd.nist.gov/vuln/detail/CVE-2026-4944

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed8.8
    vLLM CVE-2026-54232: Dependency confusion flaw in vLLM Dockerfile

    Patch now · Disclosed · since 22 Jun 2026 · CVE-2026-54232

    AI
  2. closed7.5
    vLLM CVE-2026-41523: vLLM Security Check Bypass via assert Statement

    Patch now · Disclosed · since 16 Jun 2026 · updated 22 Jun 2026 · CVE-2026-41523

    AI
  3. closed6.5
    vLLM CVE-2026-47155: vLLM artifact pin decay allows loading unpinned code and weights

    Patch now · Disclosed · since 10 Jun 2026 · updated 22 Jun 2026 · CVE-2026-47155

    AI
  4. closed8.8
    vLLM CVE-2026-5817: Docker Model Runner vllm-metal arbitrary code execution vulnerability

    Patch now · Disclosed · since 22 May 2026 · CVE-2026-5817

    AI
  5. closed9.8
    Guardrails AI CVE-2026-31233: Guardrails AI code injection in Hub installer

    Supply chain · Disclosed · since 12 May 2026 · CVE-2026-31233

    AI
  6. closed8.2
    LangChain family CVE-2026-44843: LangChain vulnerable to unsafe deserialization

    Patch now · Disclosed · since 8 May 2026 · updated 26 May 2026 · CVE-2026-44843

    AI