vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0.
PUBLISHED5.2CWE-94CWE-617
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
Problem type
Affected products
vllm-project
vllm
< 0.22.0 - AFFECTED
References
https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r
https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r
https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3
https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3
https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c
https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c
GitHub Security Advisories
GHSA-q8gq-377p-jq3r
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution
https://github.com/advisories/GHSA-q8gq-377p-jq3rSummary
An assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1).
Details
vLLM uses an assert statement at vllm/model_executor/layers/pooler/activations.py:48 as its sole security control to restrict which activation functions can be loaded from a HuggingFace model's config.json:
# vllm/model_executor/layers/pooler/activations.py:35-53
function_name: str | None = None
if (
hasattr(config, "sentence_transformers")
and "activation_fn" in config.sentence_transformers
):
function_name = config.sentence_transformers["activation_fn"]
elif (
hasattr(config, "sbert_ce_default_activation_function")
and config.sbert_ce_default_activation_function is not None
):
function_name = config.sbert_ce_default_activation_function
if function_name is not None:
assert function_name.startswith("torch.nn.modules."), (
"Loading of activation functions is restricted to "
"torch.nn.modules for security reasons"
)
fn = resolve_obj_by_qualname(function_name)()
Python's assert statements are stripped at compile time when running in optimized mode (python -O or PYTHONOPTIMIZE=1). When the assert is absent, the attacker-controlled function_name from the model's config.json is passed directly to resolve_obj_by_qualname() — an unrestricted import gadget:
def resolve_obj_by_qualname(qualname: str) -> Any:
module_name, obj_name = qualname.rsplit(".", 1)
module = importlib.import_module(module_name)
return getattr(module, obj_name)
This is the same vulnerability class as CVE-2017-1000433 (pysaml2 assert-based auth bypass), flagged by Bandit B101 and Ruff S101, and the reason Django proactively replaced all assert-based security checks (ticket #32508).
Attacker-controlled input sources:
config.sentence_transformers["activation_fn"](line 40)config.sbert_ce_default_activation_function(line 45)
Affected call sites — get_act_fn() is called via resolve_classifier_act_fn() from:
vllm/model_executor/layers/pooler/seqwise/poolers.py:122— SequencePoolervllm/model_executor/layers/pooler/tokwise/poolers.py:130— TokenPooler
Broader systemic risk: resolve_obj_by_qualname is called from ~20 locations across the codebase with no validation of its own. Any future caller feeding user-controlled input to it without validation creates the same vulnerability class.
Suggested fix: Replace the assert with an explicit conditional raise:
if not function_name.startswith("torch.nn.modules."):
raise ValueError(
"Loading of activation functions is restricted to "
"torch.nn.modules for security reasons"
)
Impact
Arbitrary code execution. A malicious model author publishes a HuggingFace model with a crafted config.json. When a victim loads this model with vLLM running under python -O or PYTHONOPTIMIZE=1, arbitrary code executes during model initialization with the privileges of the vLLM process.
The attack requires:
- Victim loads a malicious model from HuggingFace (user interaction)
- vLLM runs under
python -OorPYTHONOPTIMIZE=1(documented in production use) - Model uses a cross-encoder architecture (e.g. BERT or RoBERTa with sequence classification)
Coordinated disclosure note: This vulnerability was also reported via huntr.com on April 2, 2026 (https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c). A GitHub Security Advisory was also filed because it is vLLM's stated preferred disclosure channel per SECURITY.md.
Fix
A fix for this was introduced in this commit: https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3
github.com
https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r
github.com
https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3
huntr.com
https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c
nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-41523
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:36005
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:36006
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-41523
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2491582
github.com
https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2300.yaml
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41523.json
github.com
https://github.com/advisories/GHSA-q8gq-377p-jq3r
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-41523Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-41523",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"dateUpdated": "2026-07-15T00:59:18.930Z",
"dateReserved": "2026-04-20T18:18:50.682Z",
"datePublished": "2026-06-22T22:18:14.494Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-06-22T22:18:14.494Z"
},
"title": "vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution",
"descriptions": [
{
"lang": "en",
"value": "vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0."
}
],
"affected": [
{
"vendor": "vllm-project",
"product": "vllm",
"versions": [
{
"version": "< 0.22.0",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-94: Improper Control of Generation of Code ('Code Injection')",
"cweId": "CWE-94",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"description": "CWE-617: Reachable Assertion",
"cweId": "CWE-617",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r",
"name": "https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r",
"tags": [
"x_refsource_CONFIRM"
]
},
{
"url": "https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3",
"name": "https://github.com/vllm-project/vllm/commit/b3c7ffcab82c2439726f8cb213800f6f38c023d3",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c",
"name": "https://huntr.com/bounties/dcb05b04-e625-41e7-adbc-bbae0cc2d64c",
"tags": [
"x_refsource_MISC"
]
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
]
},
"adp": [
{
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-06-23T12:23:42.580Z"
},
"title": "CISA ADP Vulnrichment",
"metrics": [
{}
]
},
{
"providerMetadata": {
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP",
"dateUpdated": "2026-07-15T00:59:18.930Z"
},
"datePublic": "2026-06-22T22:18:14.494Z",
"title": "vllm: vLLM: Arbitrary code execution via malicious HuggingFace model",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). An unauthenticated attacker can exploit an assert-based security check during activation function loading. By publishing a malicious HuggingFace model, an attacker can achieve arbitrary code execution on the server when vLLM runs in Python optimized mode."
}
],
"affected": [
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server 3.2",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhaiis/vllm-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.2::el9"
],
"defaultStatus": "affected",
"versions": [
{
"version": "1782951012",
"status": "unaffected",
"versionType": "rpm",
"lessThan": "*"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server 3.2",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhaiis/vllm-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.2::el9"
],
"defaultStatus": "affected",
"versions": [
{
"version": "1782951244",
"status": "unaffected",
"versionType": "rpm",
"lessThan": "*"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-cpu-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-neuron-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-spyre-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaiis/vllm-tpu-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaii/vllm-cpu-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected"
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaii/vllm-gaudi-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected"
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaii/vllm-neuron-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaii/vllm-spyre-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected"
},
{
"vendor": "Red Hat",
"product": "Red Hat AI Inference Server",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhaii/vllm-tpu-rhel9",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-aws-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected"
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-azure-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected"
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-azure-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected"
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected"
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-gaudi-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected"
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-gcp-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected"
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected"
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-kserve-agent-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-kserve-controller-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-kserve-router-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-kserve-storage-initializer-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-llm-d-kv-cache-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected"
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-vllm-gaudi-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected"
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Reachable Assertion",
"cweId": "CWE-617",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-41523",
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491582",
"name": "RHBZ#2491582",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
]
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41523.json",
"tags": [
"x_sadp-csaf-vex"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36005",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36006",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
}
],
"metrics": [
{},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
}
}
],
"workarounds": [
{
"lang": "en",
"value": "Avoid running vLLM with python -O or PYTHONOPTIMIZE=1 until updated packages are available. Only load models from trusted sources. Restrict who can deploy or update models on inference endpoints. Apply network access controls and authentication in front of vLLM APIs."
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:36005: Red Hat AI Inference Server 3.2"
},
{
"lang": "en",
"value": "RHSA-2026:36006: Red Hat AI Inference Server 3.2"
}
],
"timeline": [
{
"time": "2026-06-22T23:01:00.799Z",
"lang": "en",
"value": "Reported to Red Hat."
},
{
"time": "2026-06-22T22:18:14.494Z",
"lang": "en",
"value": "Made public."
}
]
}
]
}
}