CVE-2026-41523: vLLM assert bypass → RCE

Q: Is CVE-2026-41523 actively exploited?

No confirmed active exploitation of CVE-2026-41523 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-41523?

1. Patch: Upgrade vLLM to 0.22.0 immediately — the fix replaces the assert with an explicit conditional raise that cannot be stripped by Python's optimizer. 2. Short-term workaround: Audit all Dockerfiles, systemd units, CI/CD pipelines, and container entrypoints for PYTHONOPTIMIZE=1 or python -O flags and remove them until patched. 3. Supply chain control: Restrict vLLM model loading to internal artifact registries or explicitly approved HuggingFace organization namespaces; block loading of arbitrary third-party models in production environments. 4. Least privilege: Ensure vLLM inference processes run as non-root service accounts with minimal filesystem and outbound network permissions to limit blast radius on compromise. 5. Detection: Monitor for unexpected child process spawning, outbound network connections, or file writes originating from the vLLM process, particularly during model initialization phases. Enable audit logging on model loading events via seccomp or eBPF-based process monitoring.

Q: What systems are affected by CVE-2026-41523?

This vulnerability affects the following AI/ML architecture patterns: LLM inference pipelines, model serving, cross-encoder ranking systems, HuggingFace model loading pipelines, RAG pipelines.

Q: What is the CVSS score for CVE-2026-41523?

CVE-2026-41523 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.75%.

CISO Take

vLLM uses a bare Python assert as its sole security gate preventing attacker-controlled strings from reaching an unrestricted dynamic import function; when Python runs in optimized mode (python -O or PYTHONOPTIMIZE=1, common in production containers), that assert is silently stripped at compile time and any code path named in a HuggingFace model's config.json executes with the privileges of the inference server. With 130 downstream dependents and an EPSS placing this in the 83rd percentile for exploitation likelihood, the attack surface is broad: any vLLM deployment loading BERT or RoBERTa cross-encoder models from public HuggingFace repos under optimized Python is silently exploitable without authentication and with minimal attacker skill. The fix is already public in vLLM 0.22.0 and the commit is disclosed, narrowing the window before weaponized proofs-of-concept appear. Upgrade to 0.22.0 immediately, audit all deployment manifests and container entrypoints for PYTHONOPTIMIZE or python -O flags, and restrict model sources to internal or vetted registries.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

High severity (CVSS 7.5, AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Attack complexity is nominally high because it requires the victim to load a malicious model under optimized Python mode, but both preconditions are realistic in production: PYTHONOPTIMIZE=1 appears in many production Docker images for performance tuning, and social engineering or automated pipelines loading credible-looking HuggingFace models are common. The 83rd EPSS percentile signals meaningful relative exploitability versus the broader CVE population. With 130 downstream dependents, 55 prior CVEs in the same package, and a publicly disclosed patch, vLLM is an established high-value target in AI inference infrastructure supply chains.

How does the attack unfold?

Model Publication

Adversary publishes a malicious BERT or RoBERTa cross-encoder model to HuggingFace containing a crafted config.json with an arbitrary Python module path in the activation function field.

AML.T0058

Model Ingestion

Victim's vLLM deployment running under PYTHONOPTIMIZE=1 or python -O loads the malicious model, triggering the activation function resolution code path during model initialization.

AML.T0011.000

Assert Bypass

Python's optimized compilation strips the sole assert-based security check, allowing the attacker-controlled function name to pass unvalidated to the resolve_obj_by_qualname() dynamic import gadget.

AML.T0049

Arbitrary Code Execution

resolve_obj_by_qualname() imports and instantiates the attacker-specified Python object, executing arbitrary code with the full privileges of the vLLM inference server process.

AML.T0072

Model Publication

Adversary publishes a malicious BERT or RoBERTa cross-encoder model to HuggingFace containing a crafted config.json with an arbitrary Python module path in the activation function field.

AML.T0058

Model Ingestion

Victim's vLLM deployment running under PYTHONOPTIMIZE=1 or python -O loads the malicious model, triggering the activation function resolution code path during model initialization.

AML.T0011.000

Assert Bypass

Python's optimized compilation strips the sole assert-based security check, allowing the attacker-controlled function name to pass unvalidated to the resolve_obj_by_qualname() dynamic import gadget.

AML.T0049

Arbitrary Code Execution

resolve_obj_by_qualname() imports and instantiates the attacker-specified Python object, executing arbitrary code with the full privileges of the vLLM inference server process.

AML.T0072

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	< 0.22.0	`0.22.0`
88.6K 130 dependents Pushed today 26% patched ~51d to patch Full package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 51% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: Upgrade vLLM to 0.22.0 immediately — the fix replaces the assert with an explicit conditional raise that cannot be stripped by Python's optimizer.
Short-term workaround: Audit all Dockerfiles, systemd units, CI/CD pipelines, and container entrypoints for PYTHONOPTIMIZE=1 or python -O flags and remove them until patched.
Supply chain control: Restrict vLLM model loading to internal artifact registries or explicitly approved HuggingFace organization namespaces; block loading of arbitrary third-party models in production environments.
Least privilege: Ensure vLLM inference processes run as non-root service accounts with minimal filesystem and outbound network permissions to limit blast radius on compromise.
Detection: Monitor for unexpected child process spawning, outbound network connections, or file writes originating from the vLLM process, particularly during model initialization phases. Enable audit logging on model loading events via seccomp or eBPF-based process monitoring.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Inference Model AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0049 - Exploit Public-Facing Application AML.T0058 - Publish Poisoned Models AML.T0072 - Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

A.6.2.3 - AI supply chain A.6.2.6 - AI system security

NIST AI RMF

GOVERN 6.2 - AI risk from third-party entities

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-41523?

vLLM uses a bare Python assert as its sole security gate preventing attacker-controlled strings from reaching an unrestricted dynamic import function; when Python runs in optimized mode (python -O or PYTHONOPTIMIZE=1, common in production containers), that assert is silently stripped at compile time and any code path named in a HuggingFace model's config.json executes with the privileges of the inference server. With 130 downstream dependents and an EPSS placing this in the 83rd percentile for exploitation likelihood, the attack surface is broad: any vLLM deployment loading BERT or RoBERTa cross-encoder models from public HuggingFace repos under optimized Python is silently exploitable without authentication and with minimal attacker skill. The fix is already public in vLLM 0.22.0 and the commit is disclosed, narrowing the window before weaponized proofs-of-concept appear. Upgrade to 0.22.0 immediately, audit all deployment manifests and container entrypoints for PYTHONOPTIMIZE or python -O flags, and restrict model sources to internal or vetted registries.

Is CVE-2026-41523 actively exploited?

No confirmed active exploitation of CVE-2026-41523 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-41523?

1. Patch: Upgrade vLLM to 0.22.0 immediately — the fix replaces the assert with an explicit conditional raise that cannot be stripped by Python's optimizer. 2. Short-term workaround: Audit all Dockerfiles, systemd units, CI/CD pipelines, and container entrypoints for PYTHONOPTIMIZE=1 or python -O flags and remove them until patched. 3. Supply chain control: Restrict vLLM model loading to internal artifact registries or explicitly approved HuggingFace organization namespaces; block loading of arbitrary third-party models in production environments. 4. Least privilege: Ensure vLLM inference processes run as non-root service accounts with minimal filesystem and outbound network permissions to limit blast radius on compromise. 5. Detection: Monitor for unexpected child process spawning, outbound network connections, or file writes originating from the vLLM process, particularly during model initialization phases. Enable audit logging on model loading events via seccomp or eBPF-based process monitoring.

What systems are affected by CVE-2026-41523?

This vulnerability affects the following AI/ML architecture patterns: LLM inference pipelines, model serving, cross-encoder ranking systems, HuggingFace model loading pipelines, RAG pipelines.

What is the CVSS score for CVE-2026-41523?

CVE-2026-41523 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.75%.

What is the AI security impact?

Affected AI Architectures

LLM inference pipelinesmodel servingcross-encoder ranking systemsHuggingFace model loading pipelinesRAG pipelines

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0049 Exploit Public-Facing Application

AML.T0058 Publish Poisoned Models

AML.T0072 Reverse Shell

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: A.6.2.3, A.6.2.6

NIST AI RMF: GOVERN 6.2

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0.

Exploitation Scenario

An adversary creates a HuggingFace account and publishes a convincing BERT or RoBERTa cross-encoder model for semantic search or reranking, populated with documentation, example code, and a credible README to build apparent legitimacy. The model's config.json includes a crafted entry such as sentence_transformers.activation_fn set to a malicious module path like subprocess.Popen or a custom loader referencing an attacker-controlled module. An ML engineer or an automated model-loading pipeline in a vLLM deployment running under PYTHONOPTIMIZE=1 — a common production Docker configuration — downloads and initializes the model. During initialization the stripped assert silently allows resolve_obj_by_qualname() to import and instantiate the attacker-specified Python object, spawning a reverse shell or executing a persistence payload on the inference server with the vLLM process's privileges.

Weaknesses (CWE)

CWE-617 Reachable Assertion Primary CWE-617 Reachable Assertion Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-617 Reachable Assertion CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-617 — Reachable Assertion: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

[Implementation] Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
[Implementation] Perform input validation on user data.

Source: MITRE CWE corpus.