{"resourceId":"redhat-cve-2026-114053-vllm-trust-remote-code-rce-status","versions":[{"version":"external-284d7bae13a449592a15a9194e5e90c568820daa1a0048cf92df071afe498312","resource":{"id":"redhat-cve-2026-114053-vllm-trust-remote-code-rce-status","title":"Red Hat CVE-2026-114053: Important vLLM multimodal RCE when trust_remote_code is on; AI Inference 3.5.3 fixes some images while 'fast', RHEL AI and several OpenShift AI packages stay Affected","organization":"Red Hat Product Security","sector":"Enterprise AI inference / OpenShift AI / RHEL AI security","geography":"Global product security record (applies to U.S. SLED operators of Red Hat AI)","publishedAt":"CVE public date October 21, 2026; affected releases recorded November 3, 2026","publicationDate":"2026-10-21","eventDate":"2026-11-03","sourceName":"Red Hat Customer Portal CVE database","sourceLabel":"Vendor CVE record with statement, affected releases and package_state","sourceUrl":"https://access.redhat.com/security/cve/cve-2026-114053","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"Why now: after the Nov. 3 Red Hat AI Inference 3.5.3 wave already covered in the Nov. 4 edition, this CVE record remains the operator-facing statement of exploit conditions and residual Affected packages. CVE-2026-114053 (Important) describes unauthenticated RCE via attacker-controlled multimodal processor code_revision when trust_remote_code is enabled (vLLM 0.7.3 before 0.31.0). Red Hat rates it Important, not Critical, because exploitation needs non-default settings; the statement says Red Hat AI deployments disable remote code execution by default. Affected releases list Nov. 3 fixes under RHSA-2026:94702/94709/94717/94721/94738 for several rhaii/vllm-* images, while package_state still marks numerous rhaii-fast/* images, multiple RHEL AI 3 bootc images, and several OpenShift AI odh-vllm/kserve/llm-d packages Affected.","sledRelevance":"State, local and education operators running OpenShift AI, RHEL AI or Red Hat AI Inference must treat trust_remote_code enablement—including flags copied from day-0 model blogs—as a privileged change, and must track which image streams remain Affected after the Nov. 3 advisories. Federal KEV-style urgency does not automatically apply, but public-sector IR playbooks still need a clear default-deny posture for dynamic processor loading.","evidence":"Red Hat Security Data JSON and portal page for CVE-2026-114053: threat_severity Important; statement on default-disabled remote code; details on /tokenize multimodal code_revision path; affected_release entries dated 2026-11-03; package_state rows showing Affected for fast-channel and several RHOAI/RHEL AI packages. This is vendor security status, not an independent exploit write-up.","architectureImplications":"Prefer fixed Red Hat AI Inference 3.5.3+ digests over fast-channel images while those remain Affected; keep tokenize/inference APIs authenticated; separate any lab profile that needs trust_remote_code from production serving.","governanceImplications":"Require change tickets for trust_remote_code, model-repo integrity checks and residual Affected-package review after each AI errata batch—not only operator upgrades.","securityPrivacyImplications":"Unauthenticated callers plus trust_remote_code plus attacker-influenced model revision equals process RCE. Default-deny remote code is the primary control Red Hat documents; patching alone is incomplete while package_state still lists Affected images.","caveats":"CVE public date is Oct. 21; included now because residual Affected state and the default-deny statement are newly actionable beside Nov. 4–5 day-0 model guidance. No evidence of in-the-wild exploitation against SLED tenants is provided.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: risk reduction and hygiene after the Nov. 3 AI Inference patches. CISOs and platform owners need a crisp story that Red Hat rates this Important because remote code is off by default, while several fast-channel, RHEL AI and OpenShift AI packages still show Affected. Offer a short residual-exposure review—image inventory, trust_remote_code policy, authenticate tokenize/inference—without promising that the estate is fully clear.","engineering":"Engineering framing: map every Red Hat AI Inference, OpenShift AI vLLM/KServe and RHEL AI bootc image to the CVE package_state table, replace Affected digests where Nov. 3 RHSAs provide fixes, and enforce remote code disabled in Helm and ServingRuntime templates through GitOps. Add CI checks that fail when trust_remote_code appears in production overlays, and verify that the /tokenize path is never anonymously reachable. Keep fast-channel images out of production until their Affected rows clear. Document residual exceptions with owners and review dates rather than assuming RHSA-2026:94738 closed the estate.","delivery":"Delivery framing: run a patch-and-policy sprint, not a quiet ticket. Produce an Affected-versus-fixed inventory against CVE-2026-114053 package_state, apply available RHSA digests, capture exceptions for streams that remain Affected, and obtain security sign-off on a written trust_remote_code deny-by-default standard. Acceptance is the inventory spreadsheet, cluster evidence that production ServingRuntimes omit trust_remote_code, and a smoke test proving tokenize/inference require authentication. Re-check package_state after each subsequent AI errata batch before declaring hygiene complete."},"roleDetails":{"sales":{"customerProblem":"After a large AI Inference CVE batch, buyers still need clarity on residual Affected images and whether day-0 model flags reopen the RCE path.","stakeholders":["CISO","AI platform owner","IR / vulnerability management"],"discoveryQuestions":["Which clusters still pull rhaii-fast or unfixed odh-vllm digests?","Where is trust_remote_code set today?","Are tokenize endpoints exposed without auth?"],"valueHypothesis":"A residual-exposure review can shrink the window where Affected images or remote-code flags remain; reduction size depends on estate inventory quality.","potentialEngagement":"One-week Red Hat AI image and trust_remote_code policy review tied to CVE-2026-114053 package_state.","unsupportedClaims":["All Red Hat AI images are fixed","The flaw is Critical on Red Hat AI defaults","No further operator action is needed after RHSA-2026:94738"]},"engineering":{"fit":"Applies to any OpenShift AI, RHEL AI or Red Hat AI Inference deployment that serves vLLM, especially multimodal models.","architectureIntegration":"Pin fixed rhaii/vllm digests; keep fast channel off production; gate ServingRuntime flags through GitOps policy.","prerequisites":["Access to cluster image inventory","Errata digests for fixed streams","Policy mechanism to block trust_remote_code"],"constraints":["Several package_state rows remain Affected","Lab day-0 guides may conflict with hardened defaults","Multimodal features may pressure teams to enable remote code"],"security":"Default-deny remote code; authenticate tokenize/inference; monitor for flag drift.","proofOfValue":["Inventory shows no production fast-channel Affected digests without exception","Config search finds zero trust_remote_code in prod overlays","Tokenize endpoint requires auth in a smoke test"]},"delivery":{"work":"Inventory images against package_state, patch where fixed, document residual Affected, codify remote-code deny, and retest serving.","dependencies":["Security advisory process","GitOps owners for ServingRuntime templates","App teams using multimodal models"],"ownership":"Platform engineering owns image pins; security owns exception process; app teams own temporary lab exceptions.","skillsAdoption":"Operators need errata literacy, ServingRuntime/Helm flag review and basic authn verification.","governanceCheckpoints":["Exception board for any trust_remote_code enablement","Post-patch package_state re-check","IR playbook update referencing this CVE"],"acceptanceCriteria":["Written inventory of Affected vs fixed streams","Production configs deny trust_remote_code","Smoke test shows authenticated tokenize/inference"],"risks":["Teams assume RHSA-2026:94738 cleared all images","Day-0 blogs silently reintroduce remote code","Unauthenticated tokenize left exposed on internal networks"]}},"retrievedAt":"2026-11-05T22:08:40-06:00","enrichedAt":"2026-11-05T22:12:00-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"No direct accessibility finding; security patching workload falls on already stretched SLED platform teams.","procurementImplications":"Ask vendors and integrators which image channel (stable vs fast) and remote-code posture they ship; require digest pins in contracts for managed AI Inference.","operatingModelImplications":"Treat AI runtime flags as controlled configuration with the same rigor as firewall changes; separate lab profiles from production serving.","sourceVerification":{"openedUrl":"https://access.redhat.com/security/cve/cve-2026-114053","referenceExcerpt":"In Red Hat AI deployments, vLLM runs with remote code execution disabled by default, which natively shields standard environments from loading dynamic external logic.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}