{"id":"CVE-2026-27893","aliases":["EUVD-2026-16478","GHSA-7972-pg2x-xr59","PYSEC-2026-2297"],"status":"published","title":"vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out","description":"vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01369,"percentile":0.72099,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-501","CWE-693"],"published":"2026-03-26T23:56:53Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"PyPI","package":"vllm","fixed_in":["0.18.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"vllm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.1"},{"fixed":"0.18.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"vllm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.1"},{"fixed":"0.18.0"}]}],"versions":["0.10.1","0.10.1.1","0.10.2","0.11.0","0.11.1","0.11.2","0.12.0","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.16.0","0.17.0","0.17.1"]},{"source":"osv","ecosystem":"PyPI","package":"vllm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.1"},{"fixed":"0.18.0"}]}],"versions":["0.10.1","0.10.1.1","0.10.2","0.11.0","0.11.1","0.11.2","0.12.0","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.16.0","0.17.0","0.17.1"]}],"products":[{"vendor":"red hat","product":"red hat ai inference server"},{"vendor":"red hat","product":"red hat ai inference server 3.2"},{"vendor":"red hat","product":"red hat ai inference server 3.3"},{"vendor":"red hat","product":"red hat enterprise linux ai 3.3"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 2.25"},{"vendor":"red hat","product":"red hat openshift ai 3.3"},{"vendor":"vllm","product":"vllm"},{"vendor":"vllm-project","product":"vllm"}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vllm-project/vllm/pull/36192","tags":["x_refsource_MISC","Issue Tracking","fix","web","report"]},{"url":"https://github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27893","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452055","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27893.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19724","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19725","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8748","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8746","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8747","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10140","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10141","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27893","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2297.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7972-pg2x-xr59"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27893.json","tags":["advisory"]},{"url":"https://github.com/vllm-project/vllm","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-27893","title":"vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out","description":"vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue.","status":"published","published":"2026-03-26T23:56:53.579Z","modified":"2026-07-27T12:05:49.307Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-693","CWE-501"],"updated_at":"2026-11-02T14:19:48.826324Z"}],"euvd":[{"id":"EUVD-2026-16478","description":"vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue.","status":"published","published":"2026-03-26T23:56:53Z","modified":"2026-07-27T12:05:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:37.322622Z"}],"ghsa":[{"id":"GHSA-7972-pg2x-xr59","title":"vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out","description":"### Summary\n\n  Two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model\n  repositories even when the user has explicitly disabled remote code trust.\n\n  ### Details\n\n  **Affected files (latest main branch):**\n\n  1. `vllm/model_executor/models/nemotron_vl.py:430`\n  ```python\n  vision_model = AutoModel.from_config(config.vision_config, trust_remote_code=True)\n```\n\n  2. vllm/model_executor/models/kimi_k25.py:177\n \n```python\n  cached_get_image_processor(self.ctx.model_config.model, trust_remote_code=True)\n```\n\n  Both pass a hardcoded trust_remote_code=True to HuggingFace API calls, overriding the user's global --trust-remote-code=False setting.\n\n  Relation to prior CVEs:\n  - CVE-2025-66448 fixed auto_map resolution in vllm/transformers_utils/config.py (config loading path)\n  - CVE-2026-22807 fixed broader auto_map at startup\n  - Both fixes are present in the current code. These hardcoded instances in model files survived both patches — different code paths.\n\n### Impact\n\n  Remote code execution. An attacker can craft a malicious model repository that executes arbitrary Python code when loaded by vLLM, even when the user has explicitly set --trust-remote-code=False. This undermines the security guarantee\n  that trust_remote_code=False is intended to provide.\n\n  Remediation: Replace hardcoded trust_remote_code=True with self.config.model_config.trust_remote_code in both files. Raise a clear error if the model component requires remote code but the user hasn't opted in.","status":"published","published":"2026-03-27T15:27:20Z","modified":"2026-07-17T16:18:08Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:40:44.915484Z"}],"nvd":[{"id":"CVE-2026-27893","description":"vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue.","status":"published","published":"2026-03-27T00:16:22.333Z","modified":"2026-07-21T12:17:51.353Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-693","CWE-501"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"CVE-2026-27893","title":"vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out","description":"vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue.","status":"published","published":"2026-03-26T23:56:53.579Z","modified":"2026-10-28T02:30:53.41358212Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"GHSA-7972-pg2x-xr59","title":"vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out","description":"### Summary\n\n  Two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model\n  repositories even when the user has explicitly disabled remote code trust.\n\n  ### Details\n\n  **Affected files (latest main branch):**\n\n  1. `vllm/model_executor/models/nemotron_vl.py:430`\n  ```python\n  vision_model = AutoModel.from_config(config.vision_config, trust_remote_code=True)\n```\n\n  2. vllm/model_executor/models/kimi_k25.py:177\n \n```python\n  cached_get_image_processor(self.ctx.model_config.model, trust_remote_code=True)\n```\n\n  Both pass a hardcoded trust_remote_code=True to HuggingFace API calls, overriding the user's global --trust-remote-code=False setting.\n\n  Relation to prior CVEs:\n  - CVE-2025-66448 fixed auto_map resolution in vllm/transformers_utils/config.py (config loading path)\n  - CVE-2026-22807 fixed broader auto_map at startup\n  - Both fixes are present in the current code. These hardcoded instances in model files survived both patches — different code paths.\n\n### Impact\n\n  Remote code execution. An attacker can craft a malicious model repository that executes arbitrary Python code when loaded by vLLM, even when the user has explicitly set --trust-remote-code=False. This undermines the security guarantee\n  that trust_remote_code=False is intended to provide.\n\n  Remediation: Replace hardcoded trust_remote_code=True with self.config.model_config.trust_remote_code in both files. Raise a clear error if the model component requires remote code but the user hasn't opted in.","status":"published","published":"2026-03-27T15:27:20Z","modified":"2026-09-10T03:50:37.897591835Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"PYSEC-2026-2297","description":"vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue.","status":"published","published":"2026-03-27T00:16:22.333Z","modified":"2026-07-13T07:15:12.555154789Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"}]}}