Exploit discussion active in current signal (1 latest mentions)
Immediate actions
Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: High priority (within 72h)
NVD description
Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained.
The post reports CVE‑2026‑86169, explaining an RCE flaw in Axolotl multipack, provides a Medium article with a PoC, and notes that a patch (PR #3858) has been released.
CVE-2026-86169 Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing t… https://www.cve.org/CVERecord?id=CVE-2026-86169
Post summary
The post announces CVE‑2026‑86169, reporting an RCE in Axolotl’s multipack patch path due to a defaulting bug, but no PoC, exploit, active use, or patch is mentioned.
CVE-2026-86169. Axolotl, one of the most popular open source fine-tuning frameworks for LLMs, ships an RCE because of a default value nobody double-checked.
WHAT HAPPENED:
Axolotl through v0.18.0 has a bug in its multipack patch path. The trust_remote_code flag, which is supposed to gate whether Hugging Face lets a model repo run its own custom Python code, defaults to None instead of False.
None is not "off." Downstream, that None gets treated as true. The safety guard that's supposed to stop arbitrary code from running during model load just gets skipped.
Point base_model at a malicious Hugging Face repo, and Axolotl loads it through AutoModelForCausalLM.from_pretrained with trust_remote_code effectively forced on. Whatever Python that repo ships runs on your machine during model init. No user interaction beyond starting the fine-tuning job.
CVSS 4.0 score: 8.7-8.8, high. Attack vector network, low complexity, no privileges required. Disclosed September 5, 2026 by OffSeq Threat Radar.
WHY IT WORKS:
This is not a jailbreak or a clever prompt. It's a config default doing the opposite of what its name promises. "trust_remote_code=False" is the entire security boundary between "load some weights" and "execute someone else's code on your GPU box." A None where a False should be is enough to erase that boundary, silently, with no error and no warning in your logs.
That's the pattern worth remembering: in ML tooling, the vulnerability isn't always in the model. It's in the loader, the config parser, the glue code that decides how much trust a remote repo gets by default.
WHAT IT MEANS FOR YOU:
If your team fine-tunes models and pulls base_model or datasets from Hugging Face by name or URL, that repo is now part of your trust boundary. Anyone who can get a teammate to paste in a repo string, or who typosquats a popular model name, gets a shot at code execution on your training infra. Training boxes usually have cloud credentials, internal network access, sometimes access to your other datasets. That's a much bigger blast radius than "leaked a prompt."
FIX (Axolotl users):
BEFORE (dangerous): base_model: some-org/cool-finetune-base // trust_remote_code left unset, defaults to None, guard bypassed
AFTER (safe): explicitly set trust_remote_code: false in your config, patch to a version past 0.18.0 once available, and only flip it to true for repos you've actually reviewed.
Do you know what your fine-tuning pipeline defaults to when a flag is left unset, or are you trusting that "unset" means "off"?
#AISecurity#SupplyChainAttack#LLMSecurity
Post summary
Axolotl's default `trust_remote_code` flag is misconfigured, enabling remote code execution during model fine‑tuning; the vulnerability is described in detail and mitigated by explicitly disabling the flag or upgrading the framework.
