vLLMは、モデル初期化中にauto_map動的モジュールロードを通じてRCEの影響を受ける

The impact of CVE-2026-22807 is severe. An attacker who can control the model repository or local path used by vLLM can inject malicious Python code. This code will execute during the model loading process, before any API requests are handled. Critically, this means the attacker does not need API access to exploit the vulnerability. The attacker could install malware, steal sensitive data, or establish a persistent backdoor on the vLLM server. This vulnerability shares similarities with other remote code execution flaws where untrusted code is loaded and executed without proper validation, potentially allowing for complete system takeover.

Organizations deploying vLLM for LLM inference and serving are at risk, particularly those using untrusted or publicly accessible Hugging Face model repositories. Environments where vLLM is used for sensitive workloads or integrated with other critical systems face the highest risk. Shared hosting environments where multiple users can influence model paths are also particularly vulnerable.

• python / server:

import os
import subprocess

def check_vllm_version():
    try:
        result = subprocess.check_output(['vllm', '--version'], stderr=subprocess.STDOUT, text=True)
        version = result.strip()
        if version.startswith('0.13.'):
            print(f"vLLM version is vulnerable: {version}")
        else:
            print(f"vLLM version is not vulnerable: {version}")
    except FileNotFoundError:
        print("vLLM not found.")
    except subprocess.CalledProcessError as e:
        print(f"Error checking vLLM version: {e}")

check_vllm_version()

• python / supply-chain: Monitor Hugging Face model repositories for suspicious code or unusual file modifications. • generic web: Inspect vLLM server logs for errors related to model loading or unexpected code execution.

1. 2026-01-21Disclosure

   disclosure

2. 2026-01-21Patch

   patch

1. 予約済み2026-01-09
2. 公開日2026-01-21
3. 更新日2026-02-04
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-22807 is to upgrade vLLM to version 0.14.0 or later, which includes the necessary security fixes. If upgrading immediately is not feasible, consider restricting the allowed model repositories to trusted sources only. Implement strict input validation on model paths to prevent attackers from specifying arbitrary locations. While not a complete solution, enabling a Web Application Firewall (WAF) with rules to detect and block suspicious code execution attempts can provide an additional layer of defense. After upgrading, confirm the fix by attempting to load a known malicious model and verifying that the code execution is blocked.