CVE-2026-4944
Description
A flaw was found in vllm-project/vllm. A hardcoded setting in the model implementation files bypasses the user's explicit security configuration, which is intended to prevent the execution of remote code. This allows a remote attacker to achieve remote code execution by providing a malicious model from a HuggingFace repository. The vulnerability primarily impacts deployments loading NemotronVL or KimiK25 models, potentially leading to system compromise.
Statement
Important: This flaw in vllm allows remote code execution by bypassing user-defined security configurations. Specifically, the trust_remote_code parameter is hardcoded to True when loading NemotronVL or KimiK25 models, enabling an attacker to execute arbitrary code via malicious HuggingFace model repositories. This impacts Red Hat AI Inference Server and Red Hat OpenShift AI deployments that utilize these specific models, as it overrides explicit --trust-remote-code=False settings.
Mitigation
To mitigate this issue, ensure that only trusted models are loaded into `vllm` deployments. Restrict network access to untrusted external HuggingFace model repositories to prevent the loading of malicious NemotronVL or KimiK25 models. This operational control reduces the attack surface by limiting the sources from which models can be obtained.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context; Quality Degradation; Reduce Maintainability
The existence of hardcoded constants could cause unexpected behavior and the introduction of weaknesses during code maintenance or when making changes to the code if all occurrences are not modified. The use of hardcoded constants is an indication of poor quality.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
