Axolotl: multipack patch loads Hugging Face base models with trust_remote_code=True, giving RCE on the training node

CVSS 8.7CVE-2026-86169AI/ML frameworks & servingcurated

Impact

Axolotl through 0.18.0 defaults trust_remote_code to None rather than False in the multipack patch path, so the guard that is supposed to block remote code never fires and the model is loaded via AutoModelForCausalLM.from_pretrained with a hardcoded trust_remote_code=True. Any fine-tuning job whose base_model points at an attacker-controlled Hugging Face repository executes that repository's Python inside the training process. On a GPU fleet that means arbitrary code with the identity of the training job: the mounted dataset volumes, the cluster credentials in the pod environment, the shared filesystem, and whatever the job's service account can reach. This is the classic supply-chain path for shared training clusters where users pick their own base model from the Hub, and it needs no privileges beyond being able to submit a training config.

Who can reach it

Anyone who can influence the base_model field of a training run - a tenant submitting a fine-tune config, or anyone who can get an operator to run a config naming a malicious Hub repository. No authentication to Axolotl itself is implied; the user interaction is selecting or accepting the model.

What to do

Upgrade Axolotl past 0.18.0 to a build containing commit b62d60b (PR #3858), which restores the trust_remote_code=False default in the multipack path. Rebuild the training image and restart the job runners; running jobs are unaffected in place but any queued config using an untrusted base model should be treated as suspect. Until the image is rebuilt, restrict base_model to an internal mirror or an allowlist of vetted Hub repositories.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-86169 https://github.com/axolotl-ai-cloud/axolotl/commit/b62d60b101eea7f32532ee3c0b17c2f2430a9262 https://github.com/axolotl-ai-cloud/axolotl/pull/3858 https://github.com/axolotl-ai-cloud/axolotl/blob/v0.18.0/src/axolotl/loaders/patch_manager.py#L794-L806

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.