CVE-2026-41523

[CVE catalog]

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in Python optimized mode. vllm: vLLM: Arbitrary code execution via malicious HuggingFace model Red Hat rates this issue as having Important impact for Red Hat AI Inference Server and Red Hat OpenShift AI vLLM serving images, and Moderate impact for Red Hat Enterprise Linux AI bootc images that bundle vLLM. Exploitation requires loading an untrusted HuggingFace cross-encoder model while the vLLM process runs with Python optimized mode (python -O or PYTHONOPTIMIZE=1). Red Hat AI Inference Server 3.2/3.3 images and other components without the vulnerable pooler activation loader (vLLM < 0.14.0) are not affected. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Published

Jun 14, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.91% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "vllm",
      "ecosystem": "cpe",
      "fixed_version": "0.22.0"
    },
    {
      "name": "vllm",
      "ranges": [
        {
          "fixed": "0.22.0",
          "introduced": "",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "fixed_version": "0.22.0",
      "provider_record_id": "NVD-CVE-2026-41523"
    },
    {
      "name": "vllm",
      "ecosystem": "pip",
      "fixed_version": "0.22.0",
      "provider_record_id": "GHSA-Q8GQ-377P-JQ3R"
    }
  ]
}