vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code…
vLLM
More for vLLM RSS feed for vLLM
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Record
- CVE-2026-41523
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 22, 2026
- Source last modified
- October 25, 2026
Description
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0.
Description quoted from the NVD record.
Who is affected
vLLM is software that runs AI language models on a server so that other apps and people can use them. This flaw affects versions before 0.22.0, but only when vLLM is started in Python's optimized mode, a special way of running Python programs. A problem in a part of the product that loads pieces of an AI model means that an attacker who does not need to log in could publish a harmful model on HuggingFace, a public site for sharing AI models, and use it to run any commands they choose on your server. This flaw is rated High.
What to do
- Find out whether your organization runs vLLM, and who looks after it: the person who installed it, or an IT provider or vendor who manages it for you.
- If you run vLLM yourselves, the person who installed it should update it to version
0.22.0or later, which fixes this flaw. - If an IT provider or vendor runs vLLM for your organization, send them this advisory and ask when the update to
0.22.0will be done. - For details on the fixed release, see the vendor advisory linked on this page.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.