MediumVulnerabilityLLM-specific

CVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2

Source: NVD(opens in a new tab)
Identifier: CVE-2026-100653
Published: September 26, 2026
Record updated: October 9, 2026

Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.3%

Summary

CVE-2026-100653 affects vLLM versions 0.22.1 through 0.28.0. The operator-supplied model revision pin (--revision / --code-revision) is not applied to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures, including the WhisperFeatureExtractor and speech_tokenizer loads in vllm/model_executor/models/funaudiochat.py and the Qwen2VLConfig.from_pretrained call in vllm/model_executor/models/qwen2_vl.py. Pinned deployments therefore resolve these artifacts from the repository's default revision, so upstream changes can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the pin.

Mitigation

Fixed in 0.28.0.

Details

Scores and exploitation

CVSS score: 6.5(medium)
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Attack vector: network
Attack complexity: high
Privileges required: none
User interaction: none
EPSS: 0.3%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 10, 2026.
Disclosure date: September 26, 2026

Weaknesses and techniques

Weakness (CWE): CWE-348
AI threat technique (MITRE ATLAS): AML.T0010

Affected

Vendors: HuggingFace

Classification

Attack type: Supply chain
Attack sophistication: Moderate
AI component targeted: Inference
Impact: Integrity
Labels: security,
industry

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-100653

First tracked: September 26, 2026 at 02:08 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Topics

Inference infrastructure

Summary

Mitigation

Topics

Related items