CVE-2026-100653: vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

Vulnerability summary

CVE-2026-100653 is a high (CVSS 8.3) Use of Less Trusted Source vulnerability in vllm-project vllm. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-09-2026
   PublishedVulnerability first disclosed.
2. 01-10-2026
   Last modifiedVulnerability information updated.

Description

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in vllm/model_executor/models/funaudiochat.py and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in vllm/model_executor/models/qwen2_vl.py. As a result, deployments pinned to a reviewed revision still resolve these behavior-affecting processor, tokenizer, and config artifacts from the repository's default revision, so a later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility failure for pinned deployments; it is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trust_remote_code=False bypass. The issue is fixed in version 0.28.0.

• CWE-348Use of Less Trusted SourceThe product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.