CVE-2026-109360 in Monai
Summary
by MITRE • 10/12/2026
MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in MONAI versions prior to 1.6.1 represents a critical remote code execution flaw rooted in the insecure handling of pre-trained model weights during initialization. This issue specifically affects components that utilize the SEResNet architecture, such as SENet50, when configured with pretrained parameters set to true. The core technical deficiency lies within the internal function load_state_dict_from_url, which is responsible for retrieving weight files from remote servers. In vulnerable versions of the library, this function invokes Python's pickle module to deserialize the downloaded .pth file without enforcing the weights_only=True parameter or equivalent strict deserialization safeguards. This oversight allows arbitrary code execution because the pickle format inherently supports object instantiation and method calls during unpickling, a feature that is frequently exploited by attackers to achieve remote code execution when processing untrusted data sources.
The operational impact of this vulnerability is severe due to its reliance on network-based attacks involving plaintext HTTP connections. Because the weight files are fetched over an unencrypted protocol, on-path attackers positioned within the network infrastructure can intercept and modify the traffic in transit. By substituting the legitimate SEResNet pretrained weights with a maliciously crafted .pth file containing serialized payloads, these attackers can trigger arbitrary code execution upon the victim's system when the model is instantiated. This attack vector does not require direct access to the target machine or authentication credentials; it only requires network visibility and the ability to manipulate HTTP responses. Consequently, any application relying on MONAI for medical imaging analysis that downloads pre-trained models over standard HTTP becomes a high-risk target for supply chain-style attacks via man-in-the-middle techniques.
From a classification perspective, this vulnerability aligns with CWE-502, which denotes Deserialization of Untrusted Data, as the root cause is the unsafe unpickling of external input without proper validation or restriction to safe data types. Furthermore, it maps to MITRE ATT&CK technique T1190, Exploit Public-Facing Application, where attackers leverage vulnerabilities in internet-facing services to gain initial access. The use of plaintext HTTP also relates to CWE-319, Cleartext Transmission of Sensitive Information, although the primary severity stems from the code execution capability rather than data confidentiality loss alone. This combination creates a high-severity risk profile where network-level interception directly translates into full system compromise through malicious model weights.
To mitigate this vulnerability, organizations must immediately upgrade MONAI to version 1.6.1 or later, where the developers have implemented stricter deserialization controls that prevent arbitrary code execution during weight loading. For environments unable to upgrade instantly, a temporary mitigation involves ensuring all pre-trained model downloads occur over HTTPS with strict certificate validation to prevent on-path tampering. Additionally, applications should avoid using pretrained=True for models fetched from untrusted or public repositories unless the integrity of the source can be cryptographically verified through checksums or digital signatures before deserialization occurs. Implementing a secure software supply chain practice that validates model artifacts against known good hashes provides an additional layer of defense against this class of remote code execution attacks.