CVE-2026-41523

High [CVE-2026-41523] Arbitrary code execution via malicious HuggingFace model

CVE-2026-41523Source published Jun 22, 2026Source updated Jun 22, 2026

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0. Red Hat rates this issue as having Important impact for Red Hat AI Inference Server and Red Hat OpenShift AI vLLM serving images, and Moderate impact for Red Hat Enterprise Linux AI bootc images that bundle vLLM. Red Hat AI Inference Server 3.2/3.3 images and other components without the vulnerable pooler activation loader (vLLM < 0.14.0) are not affected. Red Hat severity: Important — CVSS…

Affected products in this advisory

• Red Hat AI Inference Server 3.2
• Red Hat AI Inference Server 3.3
• Red Hat AI Inference Server 3.4
• Red Hat Enterprise Linux AI 3.3

2 more entries in the full advisory.

Source-reported affected versions

• < 0.22.0

Source-reported fixed versions

• 0.22.0
• rhaiis/vllm-cuda-rhel9:1782951012
• rhaiis/vllm-rocm-rhel9:1782951244
• rhaiis/vllm-cuda-rhel9:1787860580

43 more entries in the full advisory.

Mitigation guidance

• Avoid running vLLM with python -O or PYTHONOPTIMIZE=1 until updated packages are available. Only load models from trusted sources. Restrict who can deploy or update models on inference endpoints. Apply network access controls and authentication in front of vLLM APIs.