CVE-2026-47155: Vllm Supply-Chain Integrity Vulnerability

CVE-2026-47155 Overview

CVE-2026-47155 affects vLLM, an inference and serving engine for large language models (LLMs). Versions prior to 0.22.0 fail to consistently apply revision pinning controls across all model artifacts. Operators using --revision or --code-revision flags can still trigger loads of dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfolder weights and configuration from an unpinned or default revision. This represents a supply-chain integrity flaw classified under [CWE-345] (Insufficient Verification of Data Authenticity). The issue is fixed in vLLM 0.22.0.

Critical Impact
Operators believe they are serving a reviewed model revision while vLLM silently resolves behavior-affecting nested or sibling artifacts from outside the pinned revision, enabling supply-chain tampering.

Affected Products

vLLM versions prior to 0.22.0
Deployments using --revision or --code-revision pinning flags
Pipelines loading GGUF files, image processors, or subfolder weights from Hugging Face Hub

Discovery Timeline

2026-06-22 - CVE-2026-47155 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-47155

Vulnerability Analysis

The vulnerability stems from inconsistent propagation of the revision and code_revision parameters across vLLM's artifact loading paths. When operators pin a model to a specific Git commit or tag using --revision, vLLM applies the pin to the primary weights and configuration. However, secondary loads such as GGUF quantized weights, Whisper audio components, image processors, retrieval-side embeddings, and same-repository subfolder artifacts call hf_hub_download and from_pretrained without forwarding the pinned revision.

This creates a trust gap. A model repository owner — or an attacker with write access to a dependency repository — can publish malicious updates to artifacts that load outside the pinned revision. The deployed inference engine then loads attacker-controlled behavior under the assumption that the pin guarantees reviewed code paths.

Root Cause

Multiple loader modules omit the revision argument when invoking Hugging Face Hub download helpers. The patch addresses these gaps in gguf_loader.py, kimi_audio.py, and additional model loader files by propagating model_config.revision to every artifact boundary.

Attack Vector

A network-reachable attacker who controls a referenced repository — or compromises a maintainer account — can update the main branch or default revision of artifacts loaded by vLLM after the operator's pinned revision was reviewed. Exploitation requires high attack complexity because the attacker must control or influence a referenced model repository, but requires no authentication or user interaction against the vLLM deployment itself.

python

# Source: https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6
# Patch in vllm/model_executor/model_loader/gguf_loader.py
# repo id/filename.gguf
if "/" in model_name_or_path and model_name_or_path.endswith(".gguf"):
    repo_id, filename = model_name_or_path.rsplit("/", 1)
    return hf_hub_download(
        repo_id=repo_id,
        filename=filename,
        revision=model_config.revision,
        cache_dir=self.load_config.download_dir,
    )
# repo_id:quant_type
elif "/" in model_name_or_path and ":" in model_name_or_path:
    repo_id, quant_type = model_name_or_path.rsplit(":", 1)

The fix adds revision=model_config.revision to the hf_hub_download call so GGUF artifacts honor the operator-supplied pin. A parallel fix in kimi_audio.py forwards the revision to the Whisper config loader:

python

# Source: https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6
whisper_config = HFWhisperConfig.from_pretrained(
    model_path,
    subfolder=KIMIA_WHISPER_SUBFOLDER,
    revision=vllm_config.model_config.revision,
)

Detection Methods for CVE-2026-47155

Indicators of Compromise

Outbound huggingface.co or hf.co requests from vLLM hosts that resolve to commit SHAs differing from the operator-supplied --revision value.
vLLM process logs showing artifact loads from main or default branches while a non-default revision was specified at launch.
Unexpected modifications to cached GGUF, processor, or subfolder files under the configured download_dir between deployments.

Detection Strategies

Enable verbose logging in vLLM and audit every hf_hub_download and from_pretrained call for an explicit revision argument.
Compare hashes of loaded artifacts against the commit hash of the pinned revision in the source repository.
Inspect deployments running vLLM versions earlier than 0.22.0 via software bill of materials (SBOM) tooling.

Monitoring Recommendations

Log and alert on Hugging Face Hub API responses that include commit hashes not matching the deployment's intended pin.
Monitor egress traffic from inference hosts and restrict it to an allowlist of approved model repositories.
Track changes to upstream model repositories referenced by production deployments using repository webhook notifications.

How to Mitigate CVE-2026-47155

Immediate Actions Required

Upgrade vLLM to version 0.22.0 or later, which propagates revision pins to all artifact boundaries.
Audit currently running vLLM deployments and confirm the loaded artifact hashes match the intended pinned revision.
Restrict outbound network access from inference hosts to a curated list of trusted Hugging Face repositories.

Patch Information

The fix is delivered in vLLM 0.22.0 via commit d26a28ab033697f55a1414b5b0435de7cd6045b6 and pull request #42616. The patch propagates model_config.revision and code_revision arguments to all hf_hub_download and from_pretrained invocations. Full advisory details are available in GHSA-3ww4-5jv9-j5gm.

Workarounds

Pre-download all model artifacts to a local directory at the reviewed revision and point vLLM to the local path instead of a Hugging Face repository identifier.
Mirror trusted model repositories internally and freeze the mirror contents to prevent upstream changes from reaching production loaders.
Set the HF_HUB_OFFLINE=1 environment variable after artifact preparation to block runtime downloads.

bash

# Pre-stage artifacts at the reviewed revision, then run vLLM offline
huggingface-cli download <repo_id> --revision <reviewed_commit_sha> \
    --local-dir /opt/models/<repo_id>

export HF_HUB_OFFLINE=1
vllm serve /opt/models/<repo_id>