CVE-2026-22807: vLLM Code Execution Fixed in 0.14.0

CVE-2026-22807 is a high severity code execution flaw (CVSS 8.8) in vLLM, the LLM serving engine, from version 0.10.1 up to before 0.14.0. It loads Hugging Face auto_map modules without checking trust_remote_code, so code in a model repo can run at startup. The fix is vLLM 0.14.0.

What's affected

vLLM from 0.10.1 to before 0.14.0. The fixed version is 0.14.0.

The flaw applies to any server where an attacker can influence the model repository or path, either a local directory or a remote Hugging Face repo. The advisory says it triggers during model load, before request handling, and needs no API access.

The record also lists Red Hat errata RHSA-2026:10184 and RHSA-2026:30087, which matters if you consume vLLM through Red Hat products.

How to check if you're exposed

Find the installed version.

pip show vllm
pip list | grep -i vllm

For containers, check the image tag and run the same command inside the container. A version from 0.10.1 up to 0.13.x is affected.

Then list every model source your servers load: Hub repository names, local paths, mounted volumes and any value that comes from configuration or user input. The risk depends on who can change those values.

What to do now

1. Upgrade vLLM to 0.14.0 or later, and rebuild any container images that pin an older version.
2. Pin models to known, reviewed repositories, and prefer fixed revisions over moving branches.
3. Do not let users or tenants choose model names or paths for your serving hosts.
4. Run model servers with the least rights possible, in an isolated network, with no cloud credentials attached.
5. Check the Red Hat errata in the record if you run a Red Hat build.
6. Add model repositories to the list of things your team reviews, in the same way as packages.

Why it matters

The weakness is CWE-94, code injection. Per the advisory, vLLM resolved auto_map entries from the model config and called a helper that executes the referenced module, even when trust_remote_code was false. That setting is the switch that is meant to stop model repos from running their own Python.

So the guard existed, but one path did not consult it. A model repo is code as well as data, and loading one from a source you do not control is the same trust decision as installing a package from it. The vector shows user interaction required, because someone has to point the server at the hostile model.

The record does not say it is exploited in the wild, and it is not on the CISA KEV list. The advisory credits bugbunny.ai for the report.

Try it yourself

When a fixed release exists, the task is to find every place that still runs the old one. See how that looks.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• vLLM advisory GHSA-2pc9-4j83-qjmr
• vLLM v0.14.0 release
• Fix pull request
• Red Hat errata RHSA-2026:10184

Last reviewed: 19 October 2026.