{"id":"CVE-2026-27893","state":"PUBLISHED","title":"vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out","description":"vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue.","publishedAt":"2026-03-26T23:56:53.579Z","updatedAt":"2026-07-27T12:05:49.307Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["vllm-project vllm"],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"version":">= 0.10.1, < 0.18.0","status":"affected"}]}],"references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59","https://github.com/vllm-project/vllm/pull/36192","https://github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72","https://access.redhat.com/security/cve/CVE-2026-27893","https://bugzilla.redhat.com/show_bug.cgi?id=2452055","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27893.json","https://access.redhat.com/errata/RHSA-2026:19724","https://access.redhat.com/errata/RHSA-2026:19725","https://access.redhat.com/errata/RHSA-2026:8748","https://access.redhat.com/errata/RHSA-2026:8746","https://access.redhat.com/errata/RHSA-2026:8747","https://access.redhat.com/errata/RHSA-2026:10140","https://access.redhat.com/errata/RHSA-2026:10141","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:19712"],"weaknesses":["CWE-693","CWE-501"],"ingestedAt":"2026-10-29T20:11:31.369Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/27xxx/CVE-2026-27893.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-27893","state":"PUBLISHED","datePublished":"2026-03-26T23:56:53.579Z","dateUpdated":"2026-07-27T12:05:49.307Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-02-24T15:19:29.717Z"},"containers":{"cna":{"title":"vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out","descriptions":[{"lang":"en","value":"vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue."}],"affected":[{"vendor":"vllm-project","product":"vllm","versions":[{"version":">= 0.10.1, < 0.18.0","status":"affected"}]}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59","name":"https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vllm-project/vllm/pull/36192","name":"https://github.com/vllm-project/vllm/pull/36192","tags":["x_refsource_MISC"]},{"url":"https://github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72","name":"https://github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-693","lang":"en","description":"CWE-693: Protection Mechanism Failure","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-03-26T23:56:53.579Z"},"source":{"advisory":"GHSA-7972-pg2x-xr59","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-27T13:26:41.908182Z","id":"CVE-2026-27893","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-27T13:52:33.526Z"}},{"title":"vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting","descriptions":[{"lang":"en","value":"A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). Two model implementation files hardcode `trust_remote_code=True` when loading sub-components. This bypasses the user's explicit `--trust-remote-code=False` security opt-out, allowing a remote attacker to achieve remote code execution through malicious model repositories."}],"affected":[{"vendor":"Red Hat","product":"Red Hat AI Inference Server 3.2","packageName":"rhaiis/vllm-cuda-rhel9","defaultStatus":"affected","versions":[{"version":"1779223654","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server 3.2","packageName":"rhaiis/vllm-rocm-rhel9","defaultStatus":"affected","versions":[{"version":"1779223651","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server 3.3","packageName":"rhaiis/vllm-cuda-rhel9","defaultStatus":"affected","versions":[{"version":"1775680192","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server 3.3","packageName":"rhaiis/vllm-rocm-rhel9","defaultStatus":"affected","versions":[{"version":"1775680262","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server 3.3","packageName":"rhaiis/model-opt-cuda-rhel9","defaultStatus":"affected","versions":[{"version":"1775749857","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI 3.3","packageName":"rhelai3/bootc-aws-cuda-rhel9","defaultStatus":"affected","versions":[{"version":"1776871984","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI 3.3","packageName":"rhelai3/bootc-azure-cuda-rhel9","defaultStatus":"affected","versions":[{"version":"1776871985","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI 3.3","packageName":"rhelai3/bootc-azure-rocm-rhel9","defaultStatus":"affected","versions":[{"version":"1776872005","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI 3.3","packageName":"rhelai3/bootc-cuda-rhel9","defaultStatus":"affected","versions":[{"version":"1776773390","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI 3.3","packageName":"rhelai3/bootc-gcp-cuda-rhel9","defaultStatus":"affected","versions":[{"version":"1776871987","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI 3.3","packageName":"rhelai3/bootc-rocm-rhel9","defaultStatus":"affected","versions":[{"version":"1776773505","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI 3.3","packageName":"rhelai3/disk-image-cuda-rhel9","defaultStatus":"affected","versions":[{"version":"1776938871","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-vllm-gaudi-rhel9","defaultStatus":"affected","versions":[{"version":"1780069069","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-vllm-cpu-rhel9","defaultStatus":"affected","versions":[{"version":"1782397826","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-vllm-cuda-rhel9","defaultStatus":"affected","versions":[{"version":"1783998774","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 2.25","packageName":"rhoai/odh-vllm-rocm-rhel9","defaultStatus":"affected","versions":[{"version":"1783998857","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.3","packageName":"rhoai/odh-vllm-gaudi-rhel9","defaultStatus":"affected","versions":[{"version":"1778600187","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.3","packageName":"rhoai/odh-vllm-cpu-rhel9","defaultStatus":"affected","versions":[{"version":"1782996080","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.3::el9"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","packageName":"rhaiis/vllm-cpu-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","packageName":"rhaiis/vllm-neuron-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","packageName":"rhaiis/vllm-spyre-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","packageName":"rhaiis/vllm-tpu-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","packageName":"rhaii/vllm-cpu-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","packageName":"rhaii/vllm-neuron-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","packageName":"rhaii/vllm-spyre-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","packageName":"rhaii/vllm-tpu-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-kserve-agent-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-kserve-controller-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-kserve-router-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-kserve-storage-initializer-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-llm-d-kv-cache-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-27893","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452055","name":"RHBZ#2452055","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27893.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19724","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19725","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8748","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8746","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8747","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10140","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10141","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42644","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-501","description":"Trust Boundary Violation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-27T12:05:49.307Z"},"datePublic":"2026-03-26T23:56:53.579Z","solutions":[{"lang":"en","value":"RHSA-2026:19724: Red Hat AI Inference Server 3.2"},{"lang":"en","value":"RHSA-2026:19725: Red Hat AI Inference Server 3.2"},{"lang":"en","value":"RHSA-2026:8748: Red Hat AI Inference Server 3.3"},{"lang":"en","value":"RHSA-2026:8746: Red Hat AI Inference Server 3.3"},{"lang":"en","value":"RHSA-2026:8747: Red Hat AI Inference Server 3.3"},{"lang":"en","value":"RHSA-2026:10140: Red Hat Enterprise Linux AI 3.3"},{"lang":"en","value":"RHSA-2026:10141: Red Hat Enterprise Linux AI 3.3"},{"lang":"en","value":"RHSA-2026:42644: Red Hat OpenShift AI 2.25"},{"lang":"en","value":"RHSA-2026:24977: Red Hat OpenShift AI 2.25"},{"lang":"en","value":"RHSA-2026:37275: Red Hat OpenShift AI 3.3"},{"lang":"en","value":"RHSA-2026:19712: Red Hat OpenShift AI 3.3"}],"timeline":[{"lang":"en","time":"2026-03-27T00:01:43.935Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-03-26T23:56:53.579Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}