Read the docs
TI-2026-71176 Aliases CVE-2026-109360GHSA-fvr7-75wp-4566

MONAI RCE via unsafe SENet pretrained weight loading over plaintext HTTP

Priority HIGH 69CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

MONAI from 0.4.0 before 1.6.1 contains a deserialization flaw (CWE-502) in how it loads pretrained weights. The SENet weights are fetched over plaintext HTTP and unpickled without weights_only=True, so code runs when a model such as SEResNet50 is built with pretrained=True. An on-path attacker can substitute a crafted .pth file to execute code, and a user must construct the model for this to happen.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that load_state_dict_from_url unpickles without weights_only=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00562 47th percentileScored 2026-11-07
Fix Fixed MONAI (Project-MONAI): 1.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Project-MONAIMONAI0.4.0 to before 1.6.11.6.1Patch availableCNA
  • MONAI VendorProject-MONAI Affected 0.4.0 to before 1.6.1 Fixed in 1.6.1 Patch available CNA

Remediation

Upgrade MONAI to version 1.6.1, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA MONAI (Project-MONAI) Fixed in 1.6.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Project-MONAI MONAI 1.6.1

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-71177 Insecure deserialization in MONAI nnUNetV2Runner allows code executionPriority LOW 32
    Show all 2 records →

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-109360
  2. 2026-10-12 Alias added: GHSA-fvr7-75wp-4566
  3. 2026-10-13 Priority changed: MEDIUM → LOW
  4. 2026-10-13 CISA SSVC decision points changed
  5. 2026-10-13 Priority changed: LOW → HIGH

References

Advisory 1

  • TI-2026-85662 MONAI accepts non-finite DICOM geometry values, corrupting inference CVSS 3.1CRITICAL 9.3
  • TI-2026-64984 MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization CVSS 4.0HIGH 8.8
  • TI-2025-36415 MONAI's unsafe use of Pickle deserialization may lead to RCE CVSS 3.1HIGH 8.8
  • TI-2026-83080 Remote code execution in MONAI Auto3DSeg algo_from_json() CVSS 4.0HIGH 8.5
  • TI-2026-64983 MONAI before 1.6.0 Remote Code Execution via NumpyReader CVSS 4.0HIGH 8.5
  • TI-2026-64982 MONAI before 1.6.0 OS Command Injection via dataset_name_or_id CVSS 4.0HIGH 8.6
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences