Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-100653

CVE-2026-100653: vLLM Model Revision Pin Bypass Vulnerability

CVE-2026-100653 is a supply-chain integrity flaw in vLLM that allows model artifacts to bypass operator-configured revision pins, potentially altering audio preprocessing and tokenizer behavior without deployment changes. This article covers technical details, affected versions from 0.22.1 to 0.28.0, reproducibility risks, and mitigation guidance.

Published:

CVE-2026-100653 Overview

CVE-2026-100653 affects vLLM, an inference and serving engine for large language models. Versions 0.22.1 through 0.28.0 fail to propagate the operator-supplied model revision pin (--revision / --code-revision) to several Hugging Face artifact loads used by the FunAudioChat and Tarsier2 architectures. Pinned deployments still resolve processor, tokenizer, and configuration artifacts from the repository's default revision. A later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility defect classified under [CWE-348: Use of Less Trusted Source].

Critical Impact

Operators who pin a reviewed revision cannot guarantee reproducibility, because unpinned Hugging Face artifact loads can silently fetch newer upstream artifacts that change model behavior.

Affected Products

  • vLLM versions 0.22.1 through 0.28.0 (FunAudioChat architecture via vllm/model_executor/models/funaudiochat.py)
  • vLLM versions 0.22.1 through 0.28.0 (Tarsier2 architecture via vllm/model_executor/models/qwen2_vl.py)
  • vLLM GGUF loader (vllm/model_executor/model_loader/gguf_loader.py) prior to the fix in 0.28.0

Discovery Timeline

  • 2026-09-26 - CVE CVE-2026-100653 published to NVD
  • 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100653

Vulnerability Analysis

The defect is a residual supply-chain integrity failure left behind after the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155. While vLLM accepts a --revision or --code-revision pin from the operator, several Hugging Face loads in the FunAudioChat and Tarsier2 code paths ignore that pin. Affected call sites include the WhisperFeatureExtractor and speech_tokenizerPreTrainedTokenizerFast loads in funaudiochat.py, and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in qwen2_vl.py. These loads resolve to the Hugging Face repository's default branch, bypassing the operator's reviewed pin.

The issue does not constitute remote code execution and does not bypass trust_remote_code=False. The impact is scoped to behavior drift: audio preprocessing, speech tokenizer behavior, and Tarsier2 configuration can change without operator action if the upstream default branch changes.

Root Cause

The root cause is incomplete propagation of the revision parameter across all artifact boundaries. Multiple from_pretrained and hf_hub_download call sites were refactored without the revision argument, so they fall back to the repository default. The fix passes model_config.revision to every Hugging Face artifact load.

Attack Vector

An attacker with the ability to push changes to the upstream default branch of a Hugging Face repository used by a pinned vLLM deployment can alter processor, tokenizer, or config artifacts. The pinned deployment will fetch the modified artifacts on next load, changing model behavior while the operator believes the pin is enforced.

python
# Patch excerpt - vllm/model_executor/model_loader/gguf_loader.py
# repo id/filename.gguf
if "/" in model_name_or_path and model_name_or_path.endswith(".gguf"):
    repo_id, filename = model_name_or_path.rsplit("/", 1)
-   return hf_hub_download(repo_id=repo_id, filename=filename)
+   return hf_hub_download(
+       repo_id=repo_id,
+       filename=filename,
+       revision=model_config.revision,
+       cache_dir=self.load_config.download_dir,
+   )
# Source: https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6
python
# Patch excerpt - vllm/model_executor/models/kimi_audio.py
whisper_config = HFWhisperConfig.from_pretrained(
    model_path,
    subfolder=KIMIA_WHISPER_SUBFOLDER,
+   revision=vllm_config.model_config.revision,
)
# Source: https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6

Detection Methods for CVE-2026-100653

Indicators of Compromise

  • Outbound HTTPS requests from vLLM hosts to huggingface.co that omit a revision query parameter or resolve to the main branch when a pin is configured.
  • Unexpected changes to cached Hugging Face artifact hashes under ~/.cache/huggingface/hub for FunAudioChat or Tarsier2 model repositories.
  • Model output drift (audio preprocessing, speech tokenization, or Tarsier2 responses) between runs that use the same operator-configured --revision.

Detection Strategies

  • Audit vLLM worker processes for from_pretrained and hf_hub_download calls that do not include a revision argument.
  • Compare the commit SHA of locally cached Hugging Face artifacts against the operator-configured pin and alert on mismatch.
  • Monitor the installed vLLM version and flag deployments running 0.22.1 through versions earlier than 0.28.0.

Monitoring Recommendations

  • Enable network egress logging on inference hosts and record all requests to huggingface.co with full path and query string.
  • Hash and inventory all files under the Hugging Face cache directory on each deploy, and alert on changes outside the deploy window.
  • Track vLLM startup logs for the resolved revision of every loaded artifact and compare against the configured pin.

How to Mitigate CVE-2026-100653

Immediate Actions Required

  • Upgrade vLLM to version 0.28.0 or later, which propagates the revision pin to all artifact boundaries.
  • Inventory all deployments using FunAudioChat, Tarsier2, Kimi Audio, or GGUF-loaded models and prioritize those for upgrade.
  • Re-pin and re-verify Hugging Face artifact caches against a known-good commit SHA after upgrading.

Patch Information

The issue is fixed in vLLM version 0.28.0 via commit d26a28ab033697f55a1414b5b0435de7cd6045b6. The patch propagates model_config.revision and code_revision to all Hugging Face artifact loads in the affected code paths. See the GitHub Security Advisory GHSA-hhv2-872h-628q and the VulnCheck advisory for vLLM 0.22.1 for full disclosure details.

Workarounds

  • Mirror required Hugging Face repositories to an internal registry and pin the mirror to a reviewed commit, removing reliance on upstream default branches.
  • Run vLLM with HF_HUB_OFFLINE=1 after pre-populating the cache with artifacts validated at the reviewed revision.
  • Restrict egress from inference hosts so only an approved internal mirror of Hugging Face is reachable.
bash
# Pre-populate the Hugging Face cache at a reviewed commit, then run offline
export HF_HOME=/opt/vllm/hf-cache
huggingface-cli download <org>/<repo> --revision <reviewed-commit-sha>
export HF_HUB_OFFLINE=1
vllm serve <org>/<repo> --revision <reviewed-commit-sha>

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne