CVE-2026-47155: vLLM revision pin bypass loads

Q: Is CVE-2026-47155 actively exploited?

No confirmed active exploitation of CVE-2026-47155 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-47155?

1. Patch: Upgrade vLLM to ≥0.22.0 immediately (PR #42616 fixes all seven identified code paths across registry.py, gguf_loader.py, roberta.py, kimi_k25.py, kimi_audio.py, and default_loader.py). 2. Audit: Identify all production vLLM deployments using --revision or --code-revision flags; flag those serving Kimi-Audio, Kimi-K2.5, BGE-M3, or GGUF-format models as highest priority. 3. Workaround (pre-patch): Snapshot and locally cache all model artifacts including secondary weights with SHA-256 hashes before deployment; configure vLLM to load from local_dir instead of live hub resolution to eliminate unpinned fetches. 4. Compliance: Review existing audit evidence that cites vLLM revision pins — those records may not accurately represent the full artifact set served in production; flag for re-attestation after patching. 5. Detection: If your environment supports HuggingFace Hub audit logging, monitor for secondary artifact fetches that reference revisions different from your configured pin.

Q: What systems are affected by CVE-2026-47155?

This vulnerability affects the following AI/ML architecture patterns: LLM inference serving, multimodal inference, embeddings and retrieval pipelines, model serving.

Q: What is the CVSS score for CVE-2026-47155?

CVE-2026-47155 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.21%.

CISO Take

vLLM's --revision and --code-revision deployment pins fail to propagate to secondary artifacts — including dynamic code modules, GGUF files, image processors, and same-repository side weights — meaning a deployment you believe is locked to an audited revision can silently load behavior-affecting components from a mutable, unreviewed source. With 130 downstream dependents and 46 prior CVEs in this package, vLLM is a high-value supply chain target; the CVSS integrity impact is rated High (I:H), directly undermining any compliance program that cites model revision pins as provenance evidence for ISO 42001 or EU AI Act audits. No public exploit or active exploitation exists today, but the window is exploitable by any adversary with write access to a secondary artifact's default branch. Upgrade to vLLM 0.22.0, which patches all affected code paths via PR #42616; until patched, switch to locally-cached, hash-verified model artifacts rather than live Hugging Face Hub resolution.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium overall risk (CVSS 6.5) with disproportionate compliance impact. High attack complexity (AC:H) limits opportunistic exploitation, requiring an adversary with write access to a HuggingFace repository's default branch or the ability to compromise a secondary artifact source. However, the integrity impact is High (I:H) and the damage is stealthy — a pinned deployment silently diverges from its audited state without any observable configuration change. For organizations using vLLM revision pins as compliance evidence under ISO 42001 or EU AI Act, this is a control failure, not merely a technical flaw. The 130-dependent blast radius means compromise of any shared secondary model artifact could cascade across downstream deployments without detection.

How does the attack unfold?

Supply Chain Positioning

Adversary gains write access to a HuggingFace model repository's default branch via compromised credentials or account takeover, targeting a model whose secondary artifacts vLLM loads without revision enforcement.

AML.T0010

Artifact Substitution

Adversary modifies secondary artifacts on the default branch — such as Whisper subfolder weights for Kimi-Audio, ColBERT side weights for BGE-M3, or GGUF files — while leaving the primary pinned revision intact to evade detection.

AML.T0010.003

Unpinned Load Triggered

On next vLLM service restart or new replica spinup, the pinned deployment fetches primary artifacts from the reviewed revision but silently pulls secondary artifacts from the adversary-modified default branch due to missing revision propagation in vLLM's loader code paths.

AML.T0010.001

Silent Behavioral Compromise

Modified secondary artifacts alter inference behavior without changing the operator's configured revision pin, leaving audit logs, compliance records, and rollback procedures referencing an artifact set that no longer matches production reality.

AML.T0109

Supply Chain Positioning

Adversary gains write access to a HuggingFace model repository's default branch via compromised credentials or account takeover, targeting a model whose secondary artifacts vLLM loads without revision enforcement.

AML.T0010

Artifact Substitution

Adversary modifies secondary artifacts on the default branch — such as Whisper subfolder weights for Kimi-Audio, ColBERT side weights for BGE-M3, or GGUF files — while leaving the primary pinned revision intact to evade detection.

AML.T0010.003

Unpinned Load Triggered

On next vLLM service restart or new replica spinup, the pinned deployment fetches primary artifacts from the reviewed revision but silently pulls secondary artifacts from the adversary-modified default branch due to missing revision propagation in vLLM's loader code paths.

AML.T0010.001

Silent Behavioral Compromise

Modified secondary artifacts alter inference behavior without changing the operator's configured revision pin, leaving audit logs, compliance records, and rollback procedures referencing an artifact set that no longer matches production reality.

AML.T0109

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	< 0.22.0	`0.22.0`
88.6K 130 dependents Pushed today 26% patched ~51d to patch Full package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I High

A None

What should I do?

5 steps

Patch: Upgrade vLLM to ≥0.22.0 immediately (PR #42616 fixes all seven identified code paths across registry.py, gguf_loader.py, roberta.py, kimi_k25.py, kimi_audio.py, and default_loader.py).
Audit: Identify all production vLLM deployments using --revision or --code-revision flags; flag those serving Kimi-Audio, Kimi-K2.5, BGE-M3, or GGUF-format models as highest priority.
Workaround (pre-patch): Snapshot and locally cache all model artifacts including secondary weights with SHA-256 hashes before deployment; configure vLLM to load from local_dir instead of live hub resolution to eliminate unpinned fetches.
Compliance: Review existing audit evidence that cites vLLM revision pins — those records may not accurately represent the full artifact set served in production; flag for re-attestation after patching.
Detection: If your environment supports HuggingFace Hub audit logging, monitor for secondary artifact fetches that reference revisions different from your configured pin.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Model Poisoning Inference Model Framework AML.T0010 - AI Supply Chain Compromise AML.T0010.001 - AI Software AML.T0010.003 - Model AML.T0109 - AI Supply Chain Rug Pull

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

8.4 - AI system lifecycle processes

NIST AI RMF

GOVERN 1.7 - Processes for tracking and managing AI risks are in place

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-47155?

vLLM's --revision and --code-revision deployment pins fail to propagate to secondary artifacts — including dynamic code modules, GGUF files, image processors, and same-repository side weights — meaning a deployment you believe is locked to an audited revision can silently load behavior-affecting components from a mutable, unreviewed source. With 130 downstream dependents and 46 prior CVEs in this package, vLLM is a high-value supply chain target; the CVSS integrity impact is rated High (I:H), directly undermining any compliance program that cites model revision pins as provenance evidence for ISO 42001 or EU AI Act audits. No public exploit or active exploitation exists today, but the window is exploitable by any adversary with write access to a secondary artifact's default branch. Upgrade to vLLM 0.22.0, which patches all affected code paths via PR #42616; until patched, switch to locally-cached, hash-verified model artifacts rather than live Hugging Face Hub resolution.

Is CVE-2026-47155 actively exploited?

No confirmed active exploitation of CVE-2026-47155 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47155?

1. Patch: Upgrade vLLM to ≥0.22.0 immediately (PR #42616 fixes all seven identified code paths across registry.py, gguf_loader.py, roberta.py, kimi_k25.py, kimi_audio.py, and default_loader.py). 2. Audit: Identify all production vLLM deployments using --revision or --code-revision flags; flag those serving Kimi-Audio, Kimi-K2.5, BGE-M3, or GGUF-format models as highest priority. 3. Workaround (pre-patch): Snapshot and locally cache all model artifacts including secondary weights with SHA-256 hashes before deployment; configure vLLM to load from local_dir instead of live hub resolution to eliminate unpinned fetches. 4. Compliance: Review existing audit evidence that cites vLLM revision pins — those records may not accurately represent the full artifact set served in production; flag for re-attestation after patching. 5. Detection: If your environment supports HuggingFace Hub audit logging, monitor for secondary artifact fetches that reference revisions different from your configured pin.

What systems are affected by CVE-2026-47155?

This vulnerability affects the following AI/ML architecture patterns: LLM inference serving, multimodal inference, embeddings and retrieval pipelines, model serving.

What is the CVSS score for CVE-2026-47155?

CVE-2026-47155 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

LLM inference servingmultimodal inferenceembeddings and retrieval pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0010 AI Supply Chain Compromise

AML.T0010.001 AI Software

AML.T0010.003 Model

AML.T0109 AI Supply Chain Rug Pull

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 8.4

NIST AI RMF: GOVERN 1.7

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do not consistently apply to all artifacts loaded for a model. A deployment that supplies --revision or --code-revision can still load dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfolder weights/config from an unpinned/default revision. This is a supply-chain integrity issue for pinned vLLM deployments. Operators can believe they are serving a reviewed model revision while vLLM resolves behavior-affecting nested or sibling artifacts outside that reviewed revision. This vulnerability is fixed in 0.22.0.

Exploitation Scenario

An adversary with write access to a HuggingFace repository (via stolen token, compromised maintainer account, or a Supply Chain Rug Pull setup) modifies the whisper-large-v3 subfolder weights on the default branch of moonshotai/Kimi-Audio-7B-Instruct. An enterprise SOC running a pinned vLLM Kimi-Audio deployment for audio threat analysis restarts their inference service after a routine maintenance window. The primary model weights load correctly from the operator's configured revision hash, but vLLM's audio tower loader (kimi_audio.py L425-L430) fetches the Whisper side weights with revision=None, pulling the adversary's modified weights silently from the default branch. The operator's audit log and compliance evidence reference only the primary revision pin, masking the secondary artifact substitution entirely. The adversary's modified audio tower now produces systematically biased transcriptions or suppresses specific audio signal patterns — with zero observable change to the deployment configuration the operator monitors for drift.

Weaknesses (CWE)

CWE-345 Insufficient Verification of Data Authenticity Primary CWE-345 Insufficient Verification of Data Authenticity Primary CWE-345 Insufficient Verification of Data Authenticity

CWE-345 — Insufficient Verification of Data Authenticity: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Source: MITRE CWE corpus.