High8.8Red Hat Linux

High [CVE-2026-27893] Remote code execution due to hardcoded trust_remote_code setting

This high-severity Red Hat Linux advisory covers CVE-2026-27893 affecting Red Hat AI Inference Server 3.2, Red Hat AI Inference Server 3.3, Red Hat Enterprise Linux AI 3.3.

CVE-2026-27893 Published Mar 26, 2026

CVE-2026-27893

Affected products & platforms

Red Hat LinuxUnclassified

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Remote code execution due to hardcoded trust_remote_code setting. Red Hat rates this important (CVSS 8.8).

Weakness: CWE-501. Affected package(s): rhaiis/vllm-cuda-rhel9:1779223654, rhelai3/bootc-azure-cuda-rhel9:1776871985, rhelai3/bootc-aws-cuda-rhel9:1776871984, rhaiis/model-opt-cuda-rhel9:1775749857, rhaiis/vllm-rocm-rhel9:1775680262, rhaiis/vllm-rocm-rhel9:1779223651.

Resolved in Red Hat advisory RHSA-2026:19712 — update the affected packages (`sudo dnf update`).

Affected products named by the advisory: Red Hat AI Inference Server 3.2; Red Hat AI Inference Server 3.3; Red Hat Enterprise Linux AI 3.3; Red Hat OpenShift AI 2.25; and 1 more.

Affected versions

rhaiis/vllm-cuda-rhel9:1779223654
rhelai3/bootc-azure-cuda-rhel9:1776871985
rhelai3/bootc-aws-cuda-rhel9:1776871984
rhaiis/model-opt-cuda-rhel9:1775749857
rhaiis/vllm-rocm-rhel9:1775680262
rhaiis/vllm-rocm-rhel9:1779223651
rhaiis/vllm-cuda-rhel9:1775680192
rhelai3/bootc-cuda-rhel9:1776773390
rhelai3/bootc-rocm-rhel9:1776773505
rhelai3/disk-image-cuda-rhel9:1776938871
rhelai3/bootc-azure-rocm-rhel9:1776872005
rhoai/odh-vllm-gaudi-rhel9:1780069069

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions

RHSA-2026:19712

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Update the affected package(s) to the fixed version shipped in RHSA-2026:19712 (`sudo dnf update` / `yum update`).

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.