CVE-2026-4944: Hardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control

Synopsis

An authentication-bypass and remote code execution vulnerability exists in vllm-project/vllm version 0.14.1, where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`nemotron_vl.py` and `kimi_k25.py`). A network-reachable attacker who can influence which HuggingFace model repository is loaded can bypass the user's explicit `--trust-remote-code=False` setting without any credentials, provided the victim interacts with a malicious model. Successful exploitation gives the attacker full code execution in the context of the vllm process, with complete access to data, the ability to modify state, and the ability to crash the service. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the vllm service or influence its model-loading requests over the network, for example by serving a malicious HuggingFace model repository from a network-accessible location.

• AuthenticationNot required

  No credentials are required; the vulnerability is triggered purely through the hardcoded parameter during model loading, without any authentication gate.

• Victim interactionRequired

  A user or operator must initiate loading of a malicious NemotronVL or KimiK25 model repository, making this a social-engineering or supply-chain vector where the victim must take an action.

• Attack complexityDetail

  Attack complexity is low; once the victim loads the malicious model, the exploit is reliable and requires no race condition, memory-layout knowledge, or other environmental pre-condition.

Blast Radius

• The attacker executes arbitrary code in the context of the vllm server process, with whatever OS-level privileges that process holds.
• All data accessible to the vllm process (model weights, inference inputs, API tokens, environment variables) is readable by the attacker.
• The attacker can write or delete files, modify persisted model state, or alter runtime configuration within the process environment.
• The attacker can terminate or crash the vllm service, interrupting inference availability for any workloads depending on it.