Skip to content
Fencer Vulns
high 7.5

CVE-2026-41523 json

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

published 2026-06-16 4 mo ago modified 2026-10-25 14 d ago also GHSA-q8gq-377p-jq3r , PYSEC-2026-2300 , EUVD-2026-38406

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
0
none known

Summary

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0.

Patch / fix

  • pypi vllm 0.22.0
  • Red Hat Red Hat AI Inference Server 3.2 1782951012, 1782951244, 1787860580, 1787884873
  • Red Hat Red Hat AI Inference Server 3.3 1787161382, 1787161803
  • Red Hat Red Hat AI Inference Server 3.4 1787151769, 1787151771, 1787151774, 1787151840
  • Red Hat Red Hat Enterprise Linux AI 3.3 1788260620, 1788260684, 1788273908, 1788273909, 1788273977, 1788290314
  • Red Hat Red Hat Enterprise Linux AI 3.4 1787243961, 1787244006, 1787253774, 1787253912, 1787253989, 1787254059, 1787310717

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-41523 updated cvss 7.5

vllm: vLLM: Arbitrary code execution via malicious HuggingFace model

  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-vllm-gaudi-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat AI Inference Server 3.2 rhaiis/vllm-cuda-rhel9 1782951012, rhaiis/vllm-cuda-rhel9 1787860580, rhaiis/vllm-rocm-rhel9 1782951244, rhaiis/vllm-rocm-rhel9 1787884873
    fixed: vendor fix RHSA-2026:61627
  • Red Hat AI Inference Server 3.3 rhaiis/vllm-cuda-rhel9 1787161382, rhaiis/vllm-rocm-rhel9 1787161803
    fixed: vendor fix RHSA-2026:59138
  • Red Hat AI Inference Server 3.4 rhaii/vllm-cpu-rhel9 1787151769, rhaii/vllm-cpu-rhel9 1789681128, rhaii/vllm-cpu-rhel9 1790075793, rhaii/vllm-cuda-rhel9 1787151771, rhaii/vllm-cuda-rhel9 1789681126, rhaii/vllm-cuda-rhel9 1790090131, +6 more
    fixed: vendor fix RHSA-2026:57380
  • Red Hat AI Inference Server 3.5 rhaii/vllm-gaudi-rhel9 1791427182
    fixed: vendor fix RHSA-2026:82061
  • Red Hat Enterprise Linux AI 3.3 rhelai3/bootc-cuda-rhel9 1788260684, rhelai3/bootc-rocm-rhel9 1788260620, rhelai3/bootc-aws-cuda-rhel9 1788273908, rhelai3/bootc-gcp-cuda-rhel9 1788273977, rhelai3/disk-image-cuda-rhel9 1788290314, rhelai3/bootc-azure-cuda-rhel9 1788273909, +1 more
    fixed: vendor fix RHSA-2026:62336
  • Red Hat Enterprise Linux AI 3.4 rhelai3/bootc-cuda-rhel9 1787243961, rhelai3/bootc-rocm-rhel9 1787244006, rhelai3/bootc-aws-cuda-rhel9 1787253912, rhelai3/bootc-gcp-cuda-rhel9 1787253774, rhelai3/disk-image-cuda-rhel9 1787310717, rhelai3/bootc-azure-cuda-rhel9 1787253989, +1 more
    fixed: vendor fix RHSA-2026:59151
  • Red Hat AI Inference Server rhaii/vllm-tpu-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, rhaii/vllm-neuron-rhel9, rhaiis/vllm-spyre-rhel9, rhaiis/vllm-neuron-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-kserve-agent-rhel9, rhoai/odh-kserve-router-rhel9, rhoai/odh-llm-d-kv-cache-rhel9, rhoai/odh-kserve-controller-rhel9, rhoai/odh-kserve-storage-initializer-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
4 mo ago

Exploit prediction

0.91% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi vllm
<0.22.0
0.22.0

Affected products

  • vllm-project vllm
  • Red Hat Red Hat AI Inference Server 3.2
  • Red Hat Red Hat AI Inference Server 3.3
  • Red Hat Red Hat AI Inference Server 3.4
  • Red Hat Red Hat Enterprise Linux AI 3.3
  • Red Hat Red Hat Enterprise Linux AI 3.4
  • Red Hat Red Hat AI Inference Server
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code
  • CWE-617 Reachable Assertion

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.