●PocketClawAI security alerts
Sign in
highCVSS 7.5NVD status: Modified

CVE-2026-41523

vLLM is an inference and serving engine for large language models (LLMs).

ComponentvLLM
Severityhigh (CVSS 7.5)
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published (NVD)2026-06-22
Last modified2026-09-04
Affected versions
vllm < 0.22.0
Fixed in0.22.0
WeaknessCWE-94CWE-617
CISA KEVnot listed

NVD description

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0.

Does CVE-2026-41523 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for vLLM.
Check my stack

What to do

  • Upgrade vLLM to 0.22.0 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other vLLM CVEs

medium
CVE-2026-109311CVSS 6.5

vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser he...

vLLM
2026-10-12medium
CVE-2026-105922CVSS 4.3

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get_token_bin_counts_and_mask of the file v...

vLLM
2026-10-06medium
CVE-2026-105775CVSS 4.3

A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/mo...

vLLM
2026-10-06medium
CVE-2026-105755CVSS 4.2

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank...

vLLM
2026-10-05low
CVE-2026-105752CVSS 3.1

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/r...

vLLM
2026-10-05medium
CVE-2026-105753CVSS 6.5

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a m...

vLLM
2026-10-05

All vLLM CVEs