CVE-2026-100841
Summary
by MITRE • 09/27/2026
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/utils.py also call pickle.loads on cached content and derive cache keys with hashlib.md5. As a result, a local user with write access to a shared or world-writable cache_dir (e.g. /tmp/monai_cache, HPC scratch, ~/.cache/monai) can place a malicious pickle file that is deserialized the next time another user's MONAI pipeline reads the cache, resulting in arbitrary code execution in that user's context. All released versions of the monai pip package are affected; no patched version is available as of the advisory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in MONAI 1.6.0 represents a critical insecure deserialization flaw within its data handling infrastructure, specifically affecting the PersistentDataset class and associated cache utilities. This issue stems from the framework's reliance on Python’s pickle module for serializing and deserializing cached data objects, which are predominantly MetaTensors used to store medical imaging metadata alongside tensor data. While MONAI explicitly prevents a specific dangerous configuration by rejecting the combination of track_meta=True with weights_only=True in torch.load calls, it fails to address the broader risk posed by its custom caching mechanisms. The cache helpers located in monai/data/utils.py continue to utilize pickle.loads for deserializing cached content and employ MD5 hashing for deriving cache keys based on file contents or paths. This architectural decision creates a significant security gap because pickle is inherently unsafe when handling untrusted data, as it can execute arbitrary code during the unpickling process through specially crafted payloads that exploit object instantiation hooks.
The operational impact of this vulnerability is severe due to the typical deployment environments where MONAI is utilized, such as High-Performance Computing clusters and shared research workstations. In these settings, cache directories like /tmp/monai_cache or ~/.cache/monai are often configured with world-writable permissions to facilitate efficient data sharing among multiple users without requiring complex permission management. A local attacker who gains write access to one of these shared cache directories can plant a malicious pickle file containing an exploit payload. When another user subsequently runs a MONAI pipeline that attempts to read from the cache, the framework will deserialize this poisoned file using pickle.loads. This action results in arbitrary code execution within the context of the victim’s user account, potentially leading to full system compromise, data exfiltration, or lateral movement within the network if the compromised host is part of a larger infrastructure.
From a classification perspective, this vulnerability aligns with CWE-502, which denotes Deserialization of Untrusted Data, and falls under MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques often leveraged during initial access or execution phases in attack chains. The root cause lies not only in the use of an unsafe serialization library but also in the lack of input validation regarding the trustworthiness of cached files. Since cache keys are derived using MD5, which is cryptographically weak and susceptible to collision attacks, there is additionally a risk that an attacker could manipulate file paths or contents to overwrite legitimate cache entries with malicious ones more easily than if stronger hashing mechanisms were employed. This combination of insecure deserialization and weak integrity checking exacerbates the severity of the flaw by lowering the barrier for successful exploitation.
Mitigation strategies must address both immediate remediation steps and long-term architectural improvements. As no patched version is currently available, users should immediately restrict write permissions on shared cache directories to prevent unauthorized parties from planting malicious files. Implementing strict file ownership rules or using isolated per-user cache locations can significantly reduce the attack surface. Additionally, developers integrating MONAI into their pipelines should consider implementing custom data loading routines that bypass the default PersistentDataset caching mechanism for untrusted environments, opting instead for manual deserialization with rigorous validation or switching to safer serialization formats like JSON or MessagePack where applicable. Future updates from the MONAI maintainers are expected to replace pickle-based caching with secure alternatives and enforce stricter controls over cache directory permissions by default to prevent this class of vulnerabilities in subsequent releases.