vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out

Summary Two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code...

Unsafe Dependency Resolution

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Unsafe Dependency Resolution in the process of loading sub-components with the trustremotecode parameter set to True, regardless of user...

GHSA-3C37-WWVX-H642 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, localstack, tritonserver-backend-vllm-cuda-12.9, vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, py3-cbor2...

CVE-2026-22778 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-4R2X-XPJR-7CVV vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-QH4C-XF7M-GXFC vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

GHSA-GRG2-63FW-F2QR vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

CVE-2026-24779 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

CVE-2026-26209 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-12.4, localstack, tritonserver-backend-vllm-cuda-12.9, vllm-openai-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, py3-cbor2...

CVE-2026-22773 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0...

vLLM 安全漏洞

vLLM is an open-source LLM-based inference and service engine that features high throughput and efficient memory usage. Versions of vLLM prior to 0.10.1 to 0.18.0 contained a security vulnerability. This vulnerability stemmed from the hardcoding of trustremotecode=True in two model implementation...

CVE-2026-27893 vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

vLLM is an inference and serving engine for large language models LLMs. Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This...

CVE-2026-27893

vLLM is an inference and serving engine for large language models LLMs. Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This...

CVE-2026-27893 vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

vLLM is an inference and serving engine for large language models LLMs. Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This...

PT-2026-28373

Name of the Vulnerable Software and Affected Versions vLLM versions 0.10.1 through 0.17.x Description vLLM is an inference and serving engine for large language models LLMs. Starting with version 0.10.1 and continuing through version 0.17.x, two model implementation files hardcode trust remote...

CVE-2026-25048 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9...

GHSA-7RGV-GQHR-FXG3 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, py3-vllm-cuda-12.4, tritonserver-backend-vllm-cuda-13.0, vllm-openai-cuda-12.9...

Server-side Request Forgery (SSRF)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via inconsistent URL parsing between the validation layer and the HTTP client in the loadfromurl and loadfromurlasy...

CVE-2026-25960

vLLM is an inference and serving engine for large language models LLMs. The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the loadfromurlasync method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses...

CVE-2026-25960 SSRF Protection Bypass in vLLM

vLLM is an inference and serving engine for large language models LLMs. The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the loadfromurlasync method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses...