The vulnerability CVE-2026-22807 affects vLLM, a large language model inference and serving engine integrated into Red Hat OpenShift AI 3.4.0-ea.1. The flaw arises because vLLM loads Hugging Face auto_map dynamic modules without validating the trust_remote_code setting, enabling remote attackers to execute arbitrary Python code during server startup by influencing the model repository or path. This code execution occurs before any API requests are handled, posing a significant risk. The affected vLLM versions are from 0.10.1 through 0.13.x. Red Hat classifies this vulnerability as important and assigns a high severity rating. The advisory notes no fixes currently available and recommends mitigation through configuration and access control.

Successful exploitation allows remote attackers to execute arbitrary code on the vLLM host during model loading, potentially compromising confidentiality, integrity, and availability of the system running Red Hat OpenShift AI. The attack can occur before any API requests are processed, increasing the risk of early compromise. This vulnerability can lead to unauthorized code execution, privilege escalation, and system control by attackers who can influence the model repository or path.

No official fix is currently provided for this vulnerability in the Red Hat OpenShift AI 3.4.0-ea.1 Early Access release. To mitigate the risk, ensure that vLLM instances are configured to load models only from trusted and verified repositories. Restrict access to the model repository path to prevent unauthorized modifications or introduction of malicious code. Implement strict access controls and integrity checks on all model sources. Since this is an Early Access release not intended for production, avoid deploying it in production environments until a fixed version is released.