CVE-2026-100841

In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/utils.py also call pickle.loads on cached content and derive cache keys with hashlib.md5. As a result, a local user with write access to a shared or world-writable cache_dir (e.g. /tmp/monai_cache, HPC scratch, ~/.cache/monai) can place a malicious pickle file that is deserialized the next time another user's MONAI pipeline reads the cache, resulting in arbitrary code execution in that user's context. All released versions of the monai pip package are affected; no patched version is available as of the advisory.

• CWE-502

• https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-636w-j999-g7x5
• https://www.vulncheck.com/advisories/monai-1.6.0-persistentdataset-remote-code-execution-via-pickle-cache

Published

Sep 27, 2026

Last Modified

Sep 27, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100835Contrast before 1.16.0 is susceptible to remote attestation …7.4
• CVE-2026-100836Contrast through 1.20.0 contains a panic vulnerability in th…4.3
• CVE-2026-100837Contrast (Edgeless Systems) through 1.20.0 performs unanchor…3.7
• CVE-2026-100838Contrast is a confidential-computing runtime for Kubernetes.…8.1
• CVE-2026-100839Contrast is a confidential-computing runtime for Kubernetes.…8.4
• CVE-2026-100840MONAI through 1.6.0 contains a remote code execution vulnera…7.8
• CVE-2026-100842MONAI through 1.6.0 contains an eval injection vulnerability…7
• CVE-2026-100843MONAI versions before 1.6.0 contain a remote code execution …7.8
• CVE-2026-100844MONAI before 1.6.0 is vulnerable to OS command injection in …8.4
• CVE-2026-100845MONAI before 1.6.0 contains an unsafe deserialization vulner…7.8
• CVE-2026-100846MONAI before 1.5.2 contains a deserialization of untrusted d…7.6
• CVE-2026-100847AzuraCast before 0.23.8 contains a DQL injection vulnerabili…7.5