Skip to content
Hermes Codex

CVE-2026-22807: vLLM Dynamic Module Auto-Map Pre-Auth Remote Code Execution

HERMES

HERMES THREAT SCORE & ENTERPRISE RISK EXPOSURE

Target: LLM Serving Core, GPU Clusters & AI Orchestration Infrastructure
Confidence: 96%
94 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 18 / 20
Weaponization 19 / 20
Exposure 18 / 20
Prevalence 19 / 20
Impact 20 / 20
Exploit Maturity 19 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-22807 at 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Hermes Threat Score assigns a 94 (CRITICAL). vLLM is the primary high-throughput LLM serving engine across modern AI infrastructure. The auto_map dynamic loading execution triggers prior to any request validation, allowing poisoned model repositories on public hubs or internal artifact registries to completely compromise high-value GPU clusters and exfiltrate tenant embeddings, model weights, and cloud IAM credentials.

HASS

HASS AGENTIC SEVERITY & PERIMETER BOUNDARY IMPACT

Target: vLLM Model Loader & Transformers Dynamic Module Resolution Engine
Confidence: 95%
82 / 100
HIGH

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 18 / 20
Tool Access 18 / 20
Privilege 13 / 15
Persistence 11 / 15
External Impact 11 / 15
Propagation 11 / 15
⚖️ Divergence & Operational Rationale

Autonomous AI agents and automated MLOps pipelines dynamically instantiate inference servers or load custom fine-tuned weights based on user tasks or benchmark evaluations. Unrestricted auto_map execution permits malicious model manifests to break out of agent sandboxes and hijack autonomous agent workflows.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-22807: vLLM Dynamic Module Auto-Map Pre-Auth Remote Code ExecutionVULNERABILITY

Connected Nodes: 3
Active Relationships (Outgoing)
→ affectsPRODUCTvLLM Inference Engine
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in vLLM Inference Engine documented in Hermes dossier.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-007: Autonomous Cascading RCE
92% VERY_HIGH

Cascading multi-stage attack chaining context injection, autonomous loop planning, and un-sandboxed execution sinks to achieve persistent root shell compromise on host machines.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-22807 weaponizes the agentic attack pattern formalized under AAP-007.”

Supporting Verified Evidence:
→ exploitsAGENTIC ATTACK_PATTERNAAP-004: Semantic Tool Poisoning
92% VERY_HIGH

Attacker registers rogue MCP tools or skills with weaponized docstrings and deceptive metadata that trick the model into routing sensitive user tasks to attacker-controlled functions.

🔍 Why is this related? (Evidence & Provenance)

“CVE-2026-22807 weaponizes the agentic attack pattern formalized under AAP-004.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

vLLM supports seamless model loading from the Hugging Face Hub, local model directories, and S3-compatible object stores via integration with transformers and custom loading utilities.

ParameterTechnical SpecificationOperational Impact
CVE IdentifierCVE-2026-22807vLLM Project Advisory GHSA-vllm-automap
Vulnerability ClassCode Injection (CWE-94) / Untrusted Module Loading (CWE-829)Unrestricted execution of arbitrary Python files during model loading
Vulnerable Componentvllm/model_executor/model_loader.py & AutoConfig resolutionModel configuration parsing and dynamic code importing
Exploitation VectorMalicious config.json containing auto_map key pointing to remote .pyPre-auth RCE executed upon worker startup or dynamic model loading
Privileges RequiredNone (PR:N)Triggers during model ingestion before API authentication handlers
Privileges ObtainedHost System User (uid running vLLM daemon / root in container)Full access to GPU compute, host memory, API tokens, and tenant data
Affected VersionsvLLM >= 0.10.1 and < 0.14.0High-throughput inference servers, Kubernetes GPU pods, Ray clusters
Fixed UpdatesvLLM 0.14.0 and 0.14.1Strict trust gating, mandatory verification of dynamic module sources

2. Vulnerability Anatomy & Root Cause Analysis

Section titled “2. Vulnerability Anatomy & Root Cause Analysis”

Unsanitized Dynamic Module Loading via auto_map

Section titled “Unsanitized Dynamic Module Loading via auto_map”

Hugging Face allows model authors to define novel architectures by embedding custom modeling code in their repositories. The config.json file specifies an auto_map mapping:

{
  "architectures": ["AdversarialCausalLM"],
  "auto_map": {
    "AutoConfig": "configuration_adversarial.AdversarialConfig",
    "AutoModelForCausalLM": "modeling_adversarial.AdversarialForCausalLM"
  }
}

In standard Hugging Face workflows, dynamic code execution is protected by the trust_remote_code=True guard rail. However, in vLLM’s internal model initialization routine (vllm/model_executor/model_loader.py), model configuration metadata was inspected using an unshielded path:

# Vulnerable vLLM model configuration loader
def _get_model_architecture(model_config: ModelConfig):
    # Retrieve configuration from HF repository or local snapshot
    hf_config = get_config(model_config.model, trust_remote_code=model_config.trust_remote_code)


    # FLAW: If auto_map was present, vLLM resolved the custom class using dynamic import
    # without propagating trust_remote_code verification to the underlying module importer
    if hasattr(hf_config, "auto_map") and "AutoModelForCausalLM" in hf_config.auto_map:
        custom_class_path = hf_config.auto_map["AutoModelForCausalLM"]
        module_name, class_name = custom_class_path.rsplit(".", 1)


        # VULNERABILITY: Dynamic module resolution directly downloads and imports Python bytecode
        # executing top-level code in modeling_adversarial.py upon module load!
        custom_module = dynamic_import_hub_module(
            model_id=model_config.model,
            module_file=f"{module_name}.py"
        )
        return getattr(custom_module, class_name)

Because dynamic_import_hub_module executes Python source code during the standard importlib evaluation step, any arbitrary Python payload embedded at the top level of the custom module (outside of any class definition) executes immediately within the runtime context of the vLLM engine.

3. Attack Vectors & Forensic Execution Flow

Section titled “3. Attack Vectors & Forensic Execution Flow”
sequenceDiagram
    autonumber
    actor Attacker as Threat Actor / Adversary
    participant Hub as Hugging Face Hub / Model Store
    participant Agent as Autonomous Agent / MLOps Pipeline
    participant Loader as vLLM Model Loader
    participant OS as Host Linux OS / GPU Runtime
    participant C2 as Attacker C2 Server


    Attacker->>Hub: Publish poisoned model repo (config.json + modeling_adversarial.py)
    Note over Hub: modeling_adversarial.py contains top-level reverse shell code
    Agent->>Loader: vllm serve attacker/poisoned-model (or API dynamic switch)
    Loader->>Hub: Fetch model weights, config.json, and custom modules
    Loader->>Loader: Parse config.json -> detect auto_map definition
    Loader->>OS: dynamic_import_hub_module() executes modeling_adversarial.py
    OS->>C2: Spawn reverse shell / exfiltrate environment secrets & AWS credentials
    C2-->>OS: Establish persistent root access to GPU cluster node
  1. Model Repository Poisoning: The adversary crafts a model repository on a public registry or compromised internal model registry, including an auto_map pointer in config.json that references modeling_adversarial.py.
  2. Payload Staging: Inside modeling_adversarial.py, the attacker places arbitrary execution code (e.g., extracting HF_TOKEN, OPENAI_API_KEY, AWS IAM instance profile tokens, or executing an interactive payload) outside function wrappers.
  3. Model Ingestion Trigger: An automated AI coding agent, evaluation harness, or human operator executes vllm serve attacker/poisoned-model or invokes a model-switching endpoint in dynamic serving setups.
  4. Pre-Authentication Execution: Before vLLM validates API keys, opens listening ports, or initializes tensor memory, dynamic_import_hub_module imports the .py script, executing the payload in the context of the host process.
  5. Lateral Movement & GPU Cluster Takeover: The attacker gains interactive shell access on the host or Kubernetes pod, accessing high-bandwidth NVLink/RoCE networks and harvesting cached model weights and tenant inference logs.

4. Forensic Investigation & Incident Response

Section titled “4. Forensic Investigation & Incident Response”

DFIR analysts investigating potential exploitation of CVE-2026-22807 should review the following indicators across model cache directories and container runtimes:

Host & Container Triage Commands

Section titled “Host & Container Triage Commands”
Terminal window
# 1. Inspect Hugging Face dynamic module cache for unauthorized custom scripts
find ~/.cache/huggingface/modules/ -type f -name "*.py" -exec ls -la {} +


# 2. Review recent vLLM process startup parameters and arguments
ps aux | grep vllm | grep -E "model|trust-remote-code"


# 3. Detect unauthorized child processes spawned from the python vLLM daemon
pstree -p $(pgrep -f "vllm.entrypoints")


# 4. Search for newly established outbound connections from GPU workers
ss -tp | grep -E "python|ray"


# 5. Audit system calls and shell launches from Python processes
ausearch -p $(pgrep -f "vllm") -m EXECVE -ts today

5. Threat Hunting & Detection Engineering

Section titled “5. Threat Hunting & Detection Engineering”
title: Suspicious Child Process Spawned by vLLM Inference Engine
id: 22807c01-vllm-automap-rce-detection
status: experimental
description: Detects suspicious interactive shells or network utilities spawned directly by the vLLM serving process, indicative of CVE-2026-22807 exploitation.
author: Hermes Codex Detection Engineering
date: 2026-09-24
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'vllm.entrypoints'
      - 'vllm'
  selection_child:
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/curl'
      - '/usr/bin/wget'
      - '/usr/bin/nc'
      - '/usr/bin/python3'
      - '/usr/bin/python'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate healthcheck scripts executed under non-standard supervision trees.
level: critical
tags:
  - attack.execution
  - attack.t1059.006
  - cve.2026-22807

6. Remediation & Hardening Roadmap

Section titled “6. Remediation & Hardening Roadmap”

Upgrading vLLM Engine

Section titled “Upgrading vLLM Engine”

Upgrade your vLLM deployment immediately to version 0.14.0 or 0.14.1:

Terminal window
pip install --upgrade vllm>=0.14.1

Defense-in-Depth Mitigations

Section titled “Defense-in-Depth Mitigations”
  1. Explicit Remote Code Blocking: Never pass --trust-remote-code to vllm serve unless the model repository has been audited and cryptographically signed.
  2. Model Registry Caching & Signing: Prohibit vLLM instances in production clusters from accessing external public Hugging Face Hub endpoints. Enforce an internal, air-gapped model registry where models must be scanned for malicious serialization or custom dynamic modules before approval.
  3. Container Sandboxing: Run vLLM pods with non-root user identities (runAsNonRoot: true), drop all Linux capabilities (cap_drop: ["ALL"]), and enforce read-only container root filesystems (readOnlyRootFilesystem: true).

7. Correlated Research & Internal References

Section titled “7. Correlated Research & Internal References”

Sources & References

Section titled “Sources & References”