vLLM hat eine fest codierte Vertrauensüberschreibung in Modelldateien, die RCE trotz expliziter Benutzerablehnung ermöglicht

The core of this vulnerability lies in the bypassing of the --trust-remote-code=False security setting. Normally, this flag prevents vllm from executing code from untrusted sources, such as malicious model repositories. However, the hardcoded trustremotecode=True overrides this, allowing an attacker to craft a malicious model repository that, when loaded by vllm, executes arbitrary code on the server. The potential impact is severe, ranging from unauthorized data access and modification to complete system compromise. An attacker could potentially steal sensitive data, install malware, or use the compromised server as a launchpad for further attacks within the network. This vulnerability shares similarities with other remote code execution flaws where trust mechanisms are bypassed, highlighting the importance of carefully reviewing and configuring trust settings in machine learning frameworks.

Users deploying vllm for large language model inference, particularly those loading models from external or untrusted sources, are at significant risk. Organizations utilizing vllm in production environments, especially those with automated model deployment pipelines, should prioritize upgrading to the patched version. Shared hosting environments where multiple users may load models are also at increased risk.

• python / server:

import os
import subprocess

def check_vllm_version():
    try:
        result = subprocess.check_output(['pip', 'show', 'vllm'], stderr=subprocess.STDOUT)
        version = result.decode('utf-8').split('Version: ')[1].strip()
        if version <= '0.17.1':
            print("Vulnerable vllm version detected: {}".format(version))
        else:
            print("vllm version is safe: {}".format(version))
    except FileNotFoundError:
        print("vllm is not installed.")
    except subprocess.CalledProcessError as e:
        print("Error checking vllm version: {}".format(e))

check_vllm_version()

1. 2026-03-27Disclosure

   disclosure

2. 2026-03-27Patch

   patch

1. Reserviert2026-02-24
2. Veröffentlicht2026-03-27
3. Geändert2026-03-30
4. EPSS aktualisiert2026-04-03

The primary mitigation for CVE-2026-27893 is to upgrade vllm to version 0.18.0 or later, which includes the fix for this vulnerability. If upgrading immediately is not feasible, consider temporarily restricting access to the vllm service to trusted users only. While not a complete solution, this can limit the potential attack surface. Additionally, carefully review any model repositories used by vllm and ensure they are from trusted sources. There are no specific WAF or proxy rules that can directly address this vulnerability, as it's a code execution issue within the application itself. Detection signatures are challenging to create without specific malicious model patterns, but monitoring for unusual process execution related to vllm could be beneficial.