CVE-2026-100653

[CVE catalog]

Severity

High · CVSS 8.3CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Sep 13, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 2:16:47 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.34% · Oct 25, 2026

A flaw was found in vLLM. When operators configure a deployment to use a specific, pinned model revision, vLLM fails to apply the revision pin to certain supporting artifacts, such as model processors and configuration files. Consequently, these components are loaded from the external repository's default branch rather than the approved revision. A remote attacker with control over the upstream repository could exploit this flaw to alter model behavior and compromise deployment integrity without the operator's knowledge. vllm: vLLM: Supply chain integrity compromise via incomplete model revision pinning Red Hat is not impacted. Our portfolio makes use of vllm versions ranging from 0.8.5-0.24.0. As per the validated model matrix in ai-inference-server-3.2/3.3/3.4 (rhaiis/rhaii vllm-*) it has no FunAudioChat or Tarsier2 instead it's (Llama/Granite/Qwen/Phi/etc only). Images can still run customer-supplied Hugging Face models but that is Bring Your Own and not product default. rhel-ai-3.4 (bootc-*-rhel9) focuses on Hugging Face local Granite-class models and not FunAudioChat/Tarsier2. There is no FunAudioChat/Tarsier2 serving in rhoai-* odh-kserve-{agent,controller,router} as well. Also, rhoai-* odh-kserve-storage-initializer (includes vulnerable vllm version 0.24.0) but, does not run FunAudioChat/Tarsier2 inference paths. rhoai-* odh-vllm-gaudi is Gaudi vLLM runtime and still not a FunAudioChat/Tarsier2 validated model. Vllm versions here are also outside CVE range (0.14.1 / 0.19.1). rhoai-3.4/3.5 odh-llm-d-kv-cache is KV-cache component and not those model architectures. Lastly rhoai-3.5 odh-th-torch-cuda-py312 which is torch/training image with vLLM dep 0.21.0 which is also outside the published CVE range. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.