Vulnerability details
CVE-2026-22807
Red Hat AI Inference ServerRed Hat Enterprise Linux AI 3vllm-project vLLM
vLLM affected by RCE via auto_map dynamic module loading during model initialization
CVSS 3.1
8.8High
Official description
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 8.8High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Red Hat AI Inference Server | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| vllm-project | vLLM | >= 0.10.1, < 0.14.0 | CVEProject cvelistV5 (CNA) |
References and advisories
17- https://github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmr x_refsource_CONFIRM
- https://github.com/vllm-project/vllm/pull/32194 x_refsource_MISC
- https://github.com/vllm-project/vllm/commit/78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5 x_refsource_MISC
- https://github.com/vllm-project/vllm/releases/tag/v0.14.0 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-22807 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2431865 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22807.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:3461 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3462 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30089 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30088 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30087 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10184 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3782 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3713 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5119 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-01-22
- Last updated
- 2026-07-21
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.98%
Probability of exploitation in 30 days
62.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')