CVE-2026-27893: vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
(updated )
Two model implementation files hardcode trust_remote_code=True when loading sub-components, bypassing the user’s explicit --trust-remote-code=False security opt-out. This enables remote code execution via malicious model
repositories even when the user has explicitly disabled remote code trust.
References
- access.redhat.com/errata/RHSA-2026:10140
- access.redhat.com/errata/RHSA-2026:10141
- access.redhat.com/errata/RHSA-2026:19712
- access.redhat.com/errata/RHSA-2026:19724
- access.redhat.com/errata/RHSA-2026:19725
- access.redhat.com/errata/RHSA-2026:24977
- access.redhat.com/errata/RHSA-2026:37275
- access.redhat.com/errata/RHSA-2026:8746
- access.redhat.com/errata/RHSA-2026:8747
- access.redhat.com/errata/RHSA-2026:8748
- access.redhat.com/security/cve/CVE-2026-27893
- bugzilla.redhat.com/show_bug.cgi?id=2452055
- github.com/advisories/GHSA-7972-pg2x-xr59
- github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-2297.yaml
- github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72
- github.com/vllm-project/vllm/pull/36192
- github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59
- nvd.nist.gov/vuln/detail/CVE-2026-27893
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27893.json
Code Behaviors & Features
Detect and mitigate CVE-2026-27893 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →