CVE-2026-118684 in Monai
Summary
by MITRE • 10/28/2026
MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in MONAI versions prior to 1.6.1 represents a critical failure in the integrity verification mechanism within the check_hash function. This flaw stems from an insufficient validation of input parameters, specifically when the hash_val argument is passed as None. In this scenario, the function erroneously returns True, effectively bypassing any cryptographic checks intended to ensure file authenticity and integrity. The default configuration utilizes MD5 for hashing operations, which further compounds the risk given that MD5 has known collision vulnerabilities and is generally considered cryptographically weak for security-critical applications compared to modern standards like SHA-256 or SHA-3. This design flaw allows the system to accept files without verifying their contents against a trusted digest, creating a significant trust boundary violation within the data loading pipeline of the MONAI framework.
From an operational perspective, this vulnerability exposes users to severe security risks during the download and initialization phases of machine learning models, datasets, or bundles. Attackers capable of performing man-in-the-middle attacks on network connections or compromising package registries can intercept these downloads. By substituting legitimate archives with maliciously crafted alternatives that lack proper hash values or possess mismatched hashes, attackers can deliver malware disguised as standard model weights or data files. Since the integrity check silently passes due to the None value handling, the compromised file is accepted and loaded into memory without raising any warnings or errors. This silent acceptance facilitates the execution of arbitrary code within the user's environment when the malicious bundle or dataset is processed by subsequent MONAI components that assume the input has been verified for authenticity.
The impact extends beyond simple data corruption to potential full system compromise, particularly in automated training pipelines where models are fetched from remote sources without manual intervention. An adversary could inject backdoors into neural network weights, leading to model poisoning attacks or direct exploitation of vulnerabilities within the Python runtime environment through crafted binary payloads embedded in the archives. This aligns with CWE-345 Insufficient Verification of Data Authenticity and CWE-20 Improper Input Validation, as the system fails to properly validate that a downloaded artifact matches its expected cryptographic signature before use. Furthermore, this vulnerability supports ATT&CK technique T1195 Supply Chain Compromise, where attackers exploit trusted software distribution channels to deliver malicious content, leveraging the trust users place in official repositories and model hubs.
To mitigate this risk, it is imperative for organizations using MONAI to upgrade immediately to version 1.6.1 or later, where the check_hash function has been patched to correctly handle None values by returning False or raising an exception rather than silently passing validation. Additionally, users should enforce strict network security controls such as TLS inspection and certificate pinning when downloading resources from external sources to prevent man-in-the-middle interception. Implementing a software bill of materials and verifying cryptographic hashes using strong algorithms like SHA-256 before loading any model or dataset into production environments adds an essential layer of defense. Security teams should also monitor for anomalous behavior in data ingestion pipelines, as the silent failure of integrity checks can be difficult to detect without explicit logging and monitoring strategies focused on file verification outcomes.