CVE-2026-86169: Axolotl RCE Vulnerability

CVE-2026-86169 Overview

CVE-2026-86169 is a remote code execution vulnerability in Axolotl through version 0.18.0, an open-source large language model (LLM) fine-tuning framework. The flaw resides in the multipack patch path where the trust_remote_code configuration defaults to None instead of False. This default causes the security guard to be bypassed, allowing arbitrary Python code execution. An attacker can craft a malicious Hugging Face model repository and reference it as the base_model. Axolotl then loads it through AutoModelForCausalLM.from_pretrained with a hardcoded trust_remote_code=True, executing attacker-supplied Python during model loading. The vulnerability is classified under [CWE-829: Inclusion of Functionality from Untrusted Control Sphere].

Critical Impact
Any Axolotl user who selects an untrusted Hugging Face model as base_model can be compromised, resulting in arbitrary code execution on the training host.

Affected Products

Axolotl versions up to and including 0.18.0
Axolotl patch_manager.py multipack patch loader
Axolotl deployments that invoke AutoModelForCausalLM.from_pretrained with remote model repositories

Discovery Timeline

2026-09-05 - CVE-2026-86169 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86169

Vulnerability Analysis

Axolotl integrates with Hugging Face Transformers to load pretrained model weights and configurations. When multipack sequence packing is enabled, Axolotl applies runtime monkeypatches to model architectures. The multipack patch loader checks whether the target model requires remote code execution and then invokes AutoModelForCausalLM.from_pretrained. Because the trust flag is not normalized to a boolean before evaluation, a user who omits trust_remote_code from their YAML configuration triggers the vulnerable branch. Axolotl proceeds to load the remote model with trust_remote_code=True hardcoded, executing any Python defined in the repository's modeling_*.py files.

Root Cause

The root cause is unsafe handling of the trust_remote_code configuration value in src/axolotl/loaders/patch_manager.py. The pre-patch code treated None as distinct from False, so the guard self.cfg.trust_remote_code is not None failed to block execution when the user never explicitly set the flag. The result was a security control that only functioned when explicitly configured, violating secure-by-default principles.

Attack Vector

Exploitation requires an attacker to publish a malicious Hugging Face model repository containing custom modeling code. The victim selects that repository as the Axolotl base_model in their training configuration and starts a fine-tuning run. During model loading, the malicious Python executes with the privileges of the Axolotl process. User interaction is required, but no authentication to the Axolotl host is needed. The attack surface is broad because sharing base model names is common practice in LLM community workflows.

python

# Patch from src/axolotl/loaders/patch_manager.py
# Source: https://github.com/axolotl-ai-cloud/axolotl/commit/b62d60b101eea7f32532ee3c0b17c2f2430a9262
            else:
                has_remote_code = False

-            if has_remote_code and self.cfg.trust_remote_code is not None:
-                # If explicitly set in YAML, prefer that
-                has_remote_code = self.cfg.trust_remote_code
+            if has_remote_code:
+                has_remote_code = bool(self.cfg.trust_remote_code)

            patch_for_multipack(
                self.cfg.model_config_type,

The fix coerces the configuration value to a boolean, ensuring None resolves to False and blocks remote code loading unless the operator opts in explicitly.

Detection Methods for CVE-2026-86169

Indicators of Compromise

Axolotl processes spawning child processes such as sh, bash, curl, wget, or python -c shortly after model download.
Outbound network connections from training hosts to unexpected destinations following a from_pretrained call.
Presence of modeling_*.py, configuration_*.py, or tokenization_*.py files inside cached Hugging Face model directories under ~/.cache/huggingface/.
Fine-tuning jobs referencing unfamiliar or newly created Hugging Face repositories in the base_model field.

Detection Strategies

Inspect Axolotl YAML configurations for base_model values pointing to non-vetted Hugging Face repositories.
Audit installed Axolotl versions across ML infrastructure and flag any instance at or below 0.18.0.
Monitor Python interpreter process trees on training hosts for unexpected shell or network utility invocations.

Monitoring Recommendations

Enable EDR telemetry on GPU training nodes and workstations used by ML engineers, not just production servers.
Log all outbound connections from training environments and alert on connections to non-approved domains.
Track file writes under Hugging Face cache directories and correlate with training job start events.

How to Mitigate CVE-2026-86169

Immediate Actions Required

Upgrade Axolotl to the version containing commit b62d60b101eea7f32532ee3c0b17c2f2430a9262 or later.
Explicitly set trust_remote_code: false in all Axolotl training configuration files as a defense-in-depth measure.
Restrict base_model selections to an internally vetted allowlist of Hugging Face repositories.
Isolate fine-tuning workloads in ephemeral containers or sandboxes with minimal network egress.

Patch Information

The vulnerability was fixed in Axolotl pull request #3858 via commit b62d60b. The patch modifies src/axolotl/loaders/patch_manager.py to coerce self.cfg.trust_remote_code to a boolean, ensuring that omitted or None values are treated as False. Full technical details are available in the VulnCheck Axolotl RCE Advisory.

Workarounds

Disable multipack sequence packing in Axolotl configurations until the patched release is deployed.
Pin base_model references to specific commit hashes or local paths rather than repository names.
Pre-download and code-review model repositories before referencing them in Axolotl runs.
Run Axolotl inside a container with no outbound internet access after initial model download.

bash

# Explicitly disable remote code execution in Axolotl YAML config
trust_remote_code: false
base_model: /opt/models/vetted/llama-3-8b