CVE-2026-4944: Hardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control
vllm-project/vllm version 0.14.1 contains a vulnerability where the trustremotecode=True parameter is hardcoded in two model implementation files (vllm/modelexecutor/models/nemotronvl.py and vllm/modelexecutor/models/kimik25.py). This bypasses the user's explicit --trust-remote-code=False setting, enabling remote code execution via malicious HuggingFace model repositories. This issue is an incomplete fix for CVE-2025-66448 and CVE-2026-22807, as it affects separate code paths in model implementation files. Deployments loading NemotronVL or KimiK25 models are particularly impacted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
vllm/model_executor/models/nemotron_vl.pyfrom your environment.Do not load or deploy NemotronVL models (using vllm/model_executor/models/nemotron_vl.py) until the hardcoded trust_remote_code issue is removed or a patched release is available. Remove or disable this model implementation if it is not required.
- Remove
Remove
vllm/model_executor/models/kimi_k25.pyfrom your environment.Do not load or deploy KimiK25 models (using vllm/model_executor/models/kimi_k25.py) until the hardcoded trust_remote_code issue is removed or a patched release is available. Remove or disable this model implementation if it is not required.
- Configuration
Edit the two model implementation files (vllm/model_executor/models/nemotron_vl.py and vllm/model_executor/models/kimi_k25.py) to remove the hardcoded trust_remote_code=True. Instead, set trust_remote_code=False by default or read and respect the global/user --trust-remote-code setting so the user's explicit preference is not bypassed.
vllm/model_executor/models/nemotron_vl.py and vllm/model_executor/models/kimi_k25.py trust_remote_code = False or honor user-provided --trust-remote-code flag - Compensating control
Prevent loading models from untrusted external repositories (e.g., unvetted HuggingFace repos): restrict network access to model hosting services, require models to be pre-vetted and stored locally or in an approved artifact repository, and only allow model downloads from trusted sources until the code is fixed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4944?
The severity of CVE-2026-4944 is high with a CVSS score of 8.8.
How do I fix CVE-2026-4944?
To mitigate CVE-2026-4944, update to the latest version of vllm that removes the hardcoded trust_remote_code=True parameter.
What does CVE-2026-4944 affect?
CVE-2026-4944 affects the vllm-project/vllm version 0.14.1 software.
What is the impact of exploiting CVE-2026-4944?
Exploiting CVE-2026-4944 allows attackers to bypass user security controls, potentially leading to unauthorized code execution.
When was CVE-2026-4944 published?
CVE-2026-4944 was published on May 28, 2026.