CVE-2026-4944: vLLM remote code execution via hardcoded trust_remote_code parameter

CVE-2026-4944 · Severity: high · CVSS 8.8 · Published 2026-05-28

vLLM is a high-performance engine used to serve large language models (LLMs). A security flaw in specific model implementations allows the engine to automatically execute untrusted code from external model repositories, even if the administrator has explicitly disabled this feature. If an attacker convinces a user or system to load a malicious model from a platform like HuggingFace, they could gain full control over the server running the AI service.

Quick answers

Is CVE-2026-4944 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4944 being exploited in the wild.
How severe is CVE-2026-4944?
High severity, with a CVSS score of 8.8, published 28 May 2026.
Which products and versions are affected?
vllm-project vLLM 0.14.1.
Is there a fix for CVE-2026-4944?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-4944 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-4944?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A remote code execution (RCE) vulnerability exists in vLLM v0.14.1 due to hardcoded `trust_remote_code=True` parameters within the `nemotron_vl.py` and `kimi_k25.py` model executor files. This configuration bypasses the global `--trust-remote-code=False` flag intended to prevent the execution of arbitrary Python code bundled with models. An attacker can exploit this by hosting a malicious model on a remote repository (e.g., HuggingFace) that, when loaded by a vLLM instance using these specific architectures, executes arbitrary code on the host system. This represents an incomplete fix for previous vulnerabilities (CVE-2025-66448 and CVE-2026-22807) where specific code paths remained unprotected.

Affected products

  • vllm-project vLLM 0.14.1

Timeline

  • 2026-05-28: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.