vLLM Critical Vulnerability CVE-2026-114053 Permits Unauthenticated Remote Code Execution Before 0.31.0
A critical flaw in vLLM allows remote code execution through the tokenize endpoint, affecting versions before 0.31.0.
Key points
- CVE-2026-114053 enables arbitrary Python code execution.
- The unauthenticated /tokenize endpoint is the attack vector.
- Versions from 0.7.3 up to 0.31.0 are affected.
The vLLM inference engine contains a critical remote code execution vulnerability that exposes API processes to arbitrary command execution. Security teams managing large language model serving infrastructure should verify their version status immediately, as the flaw impacts a wide range of deployments. The issue stems from how the software handles dynamic processor code imports when handling multimodal requests.
Root cause
The vulnerability arises because vLLM forwards the `mm_processor_kwargs.code_revision` parameter directly from user requests to the Transformers library. This allows clients to specify which revision of a model's dynamic processor code is imported. When `trust_remote_code` is enabled, this mechanism permits the import of external code files. The National Vulnerability Database classifies this as CWE-94, improper control of generation of code.
Attack path
An attacker can exploit this by sending a crafted multimodal request to the unauthenticated `/tokenize` endpoint. By controlling the revision specified in the request, the attacker directs the server to import malicious Python code hosted in a model repository. This results in the execution of arbitrary Python commands within the vLLM API process context, granting the attacker full control over the service.
Affected versions
- vLLM version 0.7.3
- vLLM versions between 0.7.3 and 0.31.0
- Any version prior to 0.31.0
Mitigation
- Upgrade vLLM to version 0.31.0 or later immediately.
- Disable the `/tokenize` endpoint if upgrading is not immediately possible.
- Ensure `trust_remote_code` is disabled where not strictly required.
- Restrict network access to vLLM API endpoints to trusted sources only.
Signals worth monitoring
Teams usually detect this activity by reviewing access logs for unusual requests to the tokenize endpoint. Look for spikes in traffic from unexpected IP addresses or requests containing anomalous code revision parameters. Check system logs for unexpected Python processes spawning or network connections initiated by the API service. First containment moves involve isolating the affected server from the network and disabling the vulnerable endpoint to prevent further exploitation.
What to do and how to stay safe: vLLM
- Audit current vLLM installations to identify versions prior to 0.31.0.
- Monitor API logs for unauthorized access attempts to the tokenize endpoint.
- Disable `trust_remote_code` in configuration files if not needed for operations.
- Prepare a deployment plan to update to the patched version once available.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-114053?
The National Vulnerability Database rates the severity as 9.2, which is classified as critical.
Which endpoint is exploited in this vulnerability?
The unauthenticated /tokenize endpoint is used to trigger the remote code execution.
Is there a patch available for this flaw?
Yes, upgrading to vLLM version 0.31.0 or later resolves the issue.
