{"resourceId":"vllm-ghsa-h3rc-code-revision-rce-advisory-20261006","versions":[{"version":"external-2b5695e6d7c6d3ec839d6cac5bd1318f71861d3cfc0cc0cb97f6aebd3d038535","resource":{"id":"vllm-ghsa-h3rc-code-revision-rce-advisory-20261006","title":"vLLM advisory GHSA-h3rc-6mm3-gc2m: request-controlled code_revision allows remote code execution","organization":"vLLM project (open-source upstream of Red Hat AI Inference Server)","sector":"Inference serving security: upstream open-source advisory","geography":"Global (open-source software)","publishedAt":"GitHub Security Advisory, Oct. 6, 2026","publicationDate":"2026-10-06","eventDate":"2026-10-06","sourceName":"GitHub (vllm-project/vllm security advisories)","sourceLabel":"GHSA-h3rc-6mm3-gc2m: Request-controlled mm_processor_kwargs.code_revision allows remote code execution","sourceUrl":"https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-6mm3-gc2m","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["data-security","infrastructure","developers-agents"],"finding":"The vLLM project published a High (8.1) advisory on Oct. 6, 2026 affecting vllm >=0.7.3 and <0.31.0, patched in 0.31.0, with no CVE assigned. An untrusted multimodal request can set mm_processor_kwargs.code_revision and make vLLM import processor Python code from another revision of the served model repository. This is arbitrary code execution in the API/renderer process. It applies only when the operator has enabled trust_remote_code, the model processor uses dynamic auto_map code, and an attacker can control a revision in that repository. The default trust_remote_code=False is not affected. The advisory also notes that /tokenize is not covered by vLLM's API-key middleware unless an external proxy protects it.","sledRelevance":"vLLM is the inference engine inside Red Hat AI Inference Server and OpenShift AI model serving. State, local and university teams that serve community multimodal models with trust_remote_code enabled, or expose vLLM endpoints directly to campus or agency networks, carry this class of risk. Whether a given Red Hat build is affected depends on its bundled vLLM version, which this edition did not verify.","evidence":"Read the full GitHub advisory: affected and patched versions, preconditions, request path analysis, the reporter-suggested CVSS 9.8 versus the published 8.1 score with high attack complexity, and remediation guidance. The advisory includes an offline proof of concept. It was not reproduced. No Red Hat errata mapping to this advisory was opened.","architectureImplications":"Front vLLM endpoints with an authenticating gateway that covers every path, including /tokenize. Pin model and code revisions, and avoid trust_remote_code unless reviewed. Confirm the vLLM version bundled in Red Hat AI Inference Server or OpenShift AI images.","governanceImplications":"Model onboarding should record whether trust_remote_code is required and who approved it. Upstream advisories need tracking alongside Red Hat errata.","securityPrivacyImplications":"Code execution in the serving process could expose prompts, documents and credentials handled by the model server. The risk is conditional on non-default configuration and attacker control of a model repository revision.","caveats":"Red Hat engineers are major contributors to vLLM, so this upstream source is not fully independent of the vendor. The CVSS 8.1 rating assumes a specific non-default configuration. Mapping to Red Hat product versions was not verified.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: this is a reason to sell supported, governed inference rather than raw upstream vLLM. SLED teams experimenting with community models on bare vLLM may not track advisories like this or know when trust_remote_code is on. Position Red Hat AI Inference Server or OpenShift AI with a supported patch stream and a gateway in front. Do not claim Red Hat builds were unaffected or patched without checking the specific bundled version.","engineering":"Engineering framing: inventory every vLLM endpoint and record its version, whether trust_remote_code is enabled, and which model repositories it pulls from. Upgrade to a build carrying vLLM 0.31.0 or later, or a Red Hat-backported fix. Put an authenticating gateway in front of all paths, including /tokenize, and pin model and code revisions. Prefer models that do not need remote code; where they do, mirror and review that code internally.","delivery":"Delivery framing: add model onboarding controls covering trust_remote_code approval, revision pinning and internal mirroring, and track upstream vLLM advisories alongside Red Hat errata. Set an owner who maps each advisory to deployed builds within a defined window. Include a check that unauthenticated paths are blocked at the gateway in the release checklist for each model-serving deployment. Keep a current inventory of every serving endpoint so no shadow deployment is missed."},"roleDetails":{"sales":{"customerProblem":"Teams self-hosting open models lack visibility into inference-engine vulnerabilities and risky configuration flags.","stakeholders":["Research computing director","CISO","AI platform engineers","Data science leads"],"discoveryQuestions":["Where are you running vLLM today, and on which versions?","Do any served models require trust_remote_code?","Are inference endpoints reachable without a gateway?","How do you track upstream open-source advisories?"],"valueHypothesis":"A supported inference stack with a gateway and patch stream reduces exposure from upstream advisories compared with unmanaged deployments.","potentialEngagement":"Inference endpoint security review and migration to supported, gateway-fronted serving.","unsupportedClaims":["That Red Hat builds were or were not affected","Any exploitation in the wild","That gateways alone fully mitigate the issue"]},"engineering":{"fit":"Applies to any vLLM-based serving, including Red Hat AI Inference Server and OpenShift AI runtimes.","architectureIntegration":"Gateway in front of vLLM covering all paths; internal model mirror; revision pinning; version inventory.","prerequisites":["Inventory of vLLM deployments and versions","Gateway or proxy with authentication","Internal model registry or mirror"],"constraints":["Version mapping to Red Hat builds not verified here","Some multimodal models require remote code","Advisory has no CVE, which may limit scanner coverage"],"security":"Disable trust_remote_code by default, pin revisions, authenticate every path including /tokenize, and upgrade to patched versions.","proofOfValue":["Show an unauthenticated /tokenize request is rejected at the gateway","Show deployed vLLM versions are at or above the patched release","Show models requiring remote code are mirrored and reviewed"]},"delivery":{"work":"Inventory, upgrade and gateway-protect inference endpoints; add model onboarding controls.","dependencies":["Red Hat image release cadence","Model owner cooperation","Gateway availability"],"ownership":"AI platform team, with security operations tracking advisories.","skillsAdoption":"Train platform staff to map upstream advisories to vendor builds and configuration flags.","governanceCheckpoints":["Approval required to enable trust_remote_code","Advisory triage within the agency SLA","Release checklist for each model deployment"],"acceptanceCriteria":["Proposed: all endpoints behind authenticated gateway","Proposed: no unapproved trust_remote_code deployments","Proposed: deployed vLLM versions patched"],"risks":["Shadow vLLM deployments outside inventory","Scanner gaps for advisories without CVEs","Model owners bypassing onboarding controls"]}},"retrievedAt":"2026-10-30T03:09:23Z","enrichedAt":"2026-10-30T03:21:15Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires staff who can read upstream advisories and map them to vendor builds, a skill gap in many SLED IT shops.","procurementImplications":"Support contracts should state how quickly upstream vLLM fixes reach supported Red Hat images and how customers are notified.","operatingModelImplications":"Self-hosted inference creates a supply-chain monitoring duty across upstream projects, vendor builds and model repositories.","sourceVerification":{"openedUrl":"https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-6mm3-gc2m","referenceExcerpt":"The default trust_remote_code=False configuration is not affected.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}