PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter
Priority HIGH 72CWE-470Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 7 fixed, 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00626 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Partial lightning (PyPI): 2.6.6Red Hat: 15 advisoriesRed Hat: 7 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lightning-ai | pytorch-lightning | up to 2.6.5 | — | Patch available | CNA |
| — | lightning (PyPI) | before 2.6.6 | 2.6.6 | Patch available | GHSA-qqmf-gpg7-g8gw |
- pytorch-lightning Vendorlightning-ai Affected up to 2.6.5 Fixed in — Patch available CNA
- lightning (PyPI) Vendor— Affected before 2.6.6 Fixed in 2.6.6 Patch available GHSA-qqmf-gpg7-g8gw
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lightningai:pytorch_lightning:*:*:*:*:*:python:*:* | up to 2.6.5 | Vulnerable | lightning-ai |
- cpe:2.3:a:lightningai:pytorch_lightning:*:*:*:*:*:python:*:* Versions up to 2.6.5 Vulnerable ·lightning-ai
Remediation
- Fix · GHSA-qqmf-gpg7-g8gw lightning (PyPI) Fixed in 2.6.6 Advisory →
Red Hat 15 advisories
- RHSA-2026:92452 Released 2026-10-29 · Red Hat rating CriticalRed Hat Enterprise Linux AI 3.5.2 enhancement update
- Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:92449 Released 2026-10-29 · Red Hat rating CriticalRed Hat Enterprise Linux AI 3.5.2 enhancement update
- Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Show 12 more Red Hat advisories
- RHSA-2026:82415 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (cpu)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
- RHSA-2026:82368 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (cuda)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
- RHSA-2026:76150 Released 2026-10-05 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.4.5 security update
- Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:76149 Released 2026-10-05 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.4.5 security update
- Red Hat Enterprise Linux AI 3.4 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:76043 Released 2026-10-05 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.7 security update
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:76041 Released 2026-10-05 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.7 security update
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:70979 Released 2026-09-23 · Red Hat rating ImportantRed Hat AI Inference 3.4.5 (cuda)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
- RHSA-2026:70965 Released 2026-09-23 · Red Hat rating ImportantRed Hat AI Inference 3.4.5 (cpu)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
- RHSA-2026:69467 Released 2026-09-21 · Red Hat rating ImportantRed Hat AI Inference 3.4.5 (cuda)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cuda-rhel9
- RHSA-2026:69466 Released 2026-09-21 · Red Hat rating ImportantRed Hat AI Inference 3.4.5 (cpu)
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-cpu-rhel9
- RHSA-2026:68699 Released 2026-09-17 · Red Hat rating ImportantRed Hat AI Inference Server 3.3.7 (CUDA)
- Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
- RHSA-2026:68698 Released 2026-09-17 · Red Hat rating ImportantRed Hat AI Inference Server 3.3.7 (ROCm)
- Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AI Inference Server | Affected | No fix planned: Will not fix |
| Red Hat AI Inference Server 3.3 | Fixed | RHSA-2026:68698, RHSA-2026:68699 |
| Red Hat AI Inference Server 3.4 | Fixed | RHSA-2026:69466, RHSA-2026:69467, RHSA-2026:70965, RHSA-2026:70979 |
| Red Hat AI Inference Server 3.5 | Fixed | RHSA-2026:82368, RHSA-2026:82415 |
| Red Hat Enterprise Linux AI 3.3 | Fixed | RHSA-2026:76041, RHSA-2026:76043 |
| Red Hat Enterprise Linux AI 3.4 | Fixed | RHSA-2026:76149, RHSA-2026:76150 |
| Red Hat Enterprise Linux AI 3.5 | Fixed | RHSA-2026:92449, RHSA-2026:92452 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
Not affected: 4 products
- Red Hat Enterprise Linux AI 3.4
- Red Hat Enterprise Linux AI 3.5
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 3.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-58659
- 2026-10-03 Alias added: GHSA-qqmf-gpg7-g8gw
- 2026-10-06 Fix available: RHSA-2026:76149 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76150 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76043 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76041 · Red Hat
- 2026-10-06 Fix available: Red Hat Enterprise Linux AI 3.3, Red Hat Enterprise Linux AI 3.4 · Red Hat
- 2026-10-10 Affected versions changed · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
- 2026-10-15 Fix available: Red Hat AI Inference Server 3.5 · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
- 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5 · Red Hat
- 2026-10-31 EPSS moved to the 50th–90th percentile
References
Exploit 1
Patch 2
Advisory 2
Other 4
- https://github.com/Lightning-AI/pytorch-lightning
- https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.6
- https://github.com/pypa/advisory-database/tree/main/vulns/lightning/PYSEC-2026-3624.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2026-3967.yaml
More lightning-ai Pytorch Lightning vulnerabilities
- TI-2024-05067 RCE via Property/Class Pollution in lightning-ai/pytorch-lightning CVSS 3.1CRITICAL 9.8
- TI-2024-05541 Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning CVSS 3.1CRITICAL 9.8
- TI-2024-07433 Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning CVSS 3.1CRITICAL 9.1
- TI-2024-07434 Denial of Service in lightning-ai/pytorch-lightning CVSS 3.0HIGH 7.5
- TI-2026-32421 Compromise of PyTorch Lightning PyPi Package Versions CVSS 4.0CRITICAL 9.3
- TI-2022-00751 Code Injection in pytorchlightning/pytorch-lightning CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-58659 · CVE Program
- CVE-2026-58659 · NVD
- FIRST EPSS
- GHSA-qqmf-gpg7-g8gw · GitHub Advisory Database · CC BY 4.0
- CVE-2026-58659 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences