6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47155

CVE-2026-47155: vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's revision pinning controls do not consistently apply to all artifacts loaded for a model. A deployment that supplies --revision or --code-revision can still load dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfolder weights/config from an unpinned/default revision. This is a supply-chain integrity issue for pinned vLLM deployments. Operators can believe they are serving a reviewed model revision while vLLM resolves behavior-affecting nested or sibling artifacts outside that reviewed revision. This vulnerability is fixed in 0.22.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47155

CVE-2026-47155:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vllm	pip	< 0.22.0	0.22.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as 'Artifact Pin Decay', lies in the vLLM library's failure to consistently propagate revision pinning across all artifact loading paths. When an operator specifies a model or code revision using --revision or --code-revision, the expectation is that all associated artifacts—such as model weights, configurations, and processors—are loaded from that specific revision. However, the analysis of the provided patches reveals that this was not the case in several parts of the codebase.

The root cause of the vulnerability is the omission of the revision or code_revision parameter in various function calls responsible for downloading or loading model artifacts. This oversight leads to a situation where, despite a pinned deployment, vLLM could fetch and use artifacts from the default branch of a repository. This breaks the operational guarantee of a pinned deployment, making it difficult to ensure reproducibility, conduct security reviews, and perform reliable audits.

The identified vulnerable functions are all related to the loading of models and their components. For instance, gguf_loader._prepare_weights downloaded GGUF files without a revision, KimiAudioForCausalLM.__init__ and KimiAudioModel.__init__ loaded configurations and weights for the Kimi-Audio model from unpinned revisions, and BgeM3EmbeddingModel.__init__ did the same for secondary weights. Similarly, KimiK25ImageProcessor.__init__ loaded an image processor from the default revision, and registry._try_resolve_transformers failed to enforce the code_revision pin when loading dynamic model classes.

The patches address these issues by ensuring that the revision and code_revision from the model configuration are passed down to all relevant function calls. This ensures that all artifacts are loaded from the intended, pinned revision, thereby restoring the integrity of the deployment.

Vulnerable functions

gguf_loader._prepare_weights

vllm/model_executor/model_loader/gguf_loader.py

The function `_prepare_weights` in `gguf_loader.py` was vulnerable because it called `hf_hub_download` without specifying a `revision`. This caused the GGUF file to be downloaded from the default repository revision, even when a specific model revision was pinned in the deployment.

KimiAudioForCausalLM.__init__

vllm/model_executor/models/kimi_audio.py

The `__init__` method of `KimiAudioForCausalLM` loaded a Whisper config using `HFWhisperConfig.from_pretrained` without passing the `revision`. This meant that the config for the audio tower could be loaded from an unpinned revision, leading to unexpected behavior.

KimiAudioModel.__init__

vllm/model_executor/models/kimi_audio.py

The `__init__` method of `KimiAudioModel` declared secondary weights with `revision=None`. This caused the Whisper audio tower weights to be loaded from the default revision instead of the one specified by the operator, breaking the integrity of the pinned deployment.

KimiK25ImageProcessor.__init__

vllm/model_executor/models/kimi_k25.py

The `__init__` method of `KimiK25ImageProcessor` used `cached_get_image_processor` to load an image processor without passing the `revision`. This allowed the image processor to be resolved from the default repository revision, even when the model deployment was pinned.

registry._try_resolve_transformers

vllm/model_executor/models/registry.py

The `_try_resolve_transformers` function in `registry.py` did not forward the `code_revision` to `try_get_class_from_dynamic_module`. This meant that an operator-provided code pin was not enforced when loading dynamic model classes, potentially leading to the execution of un-audited code.

BgeM3EmbeddingModel.__init__

vllm/model_executor/models/roberta.py

The `__init__` method of `BgeM3EmbeddingModel` created secondary weight sources with `revision=None`. This caused the side weights to be downloaded from the default revision, ignoring the operator-selected model revision and compromising the integrity of the deployment.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.