CVE-2026-100841
Received Received - Intake

Arbitrary Code Execution in MONAI PersistentDataset

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/utils.py also call pickle.loads on cached content and derive cache keys with hashlib.md5. As a result, a local user with write access to a shared or world-writable cache_dir (e.g. /tmp/monai_cache, HPC scratch, ~/.cache/monai) can place a malicious pickle file that is deserialized the next time another user's MONAI pipeline reads the cache, resulting in arbitrary code execution in that user's context. All released versions of the monai pip package are affected; no patched version is available as of the advisory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100841
EUVD
EUVD-2026-87847

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
monai monai to 1.6.0 (exc)
monai monai From 1.0 (inc)
project_monai monai From 1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100841 is a deserialization vulnerability in MONAI 1.6.0's PersistentDataset class and data/utils.py. It forces weights_only=False when using MetaTensor, allowing pickle.loads for deserialization. Cache helpers use pickle.loads and MD5 hashing. Attackers with write access to shared cache directories can place malicious pickle files, leading to arbitrary code execution when the cache is read by another user.

Detection Guidance

Check for world-writable cache directories like ~/.cache/monai or /tmp/monai_cache. Look for unexpected pickle files in these directories. Commands: ls -ld ~/.cache/monai; ls -ld /tmp/monai_cache; find ~/.cache/monai -type f -name '*.pkl' -ls

Monitor for unusual process activity from MONAI applications. Check running processes: ps aux | grep -i monai. Review cache directory permissions: stat -c '%a %n' ~/.cache/monai /tmp/monai_cache

Impact Analysis

If you use MONAI in a shared environment like an HPC cluster, an attacker with access to the cache directory could execute arbitrary code in your context. This could lead to data theft, system compromise, or further attacks. Even in non-shared environments, local attackers with write access to cache directories could exploit this.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using MONAI in regulated environments must address this risk to maintain compliance.

Mitigation Strategies

Immediately restrict cache directory permissions to 0700: chmod 0700 ~/.cache/monai; chmod 0700 /tmp/monai_cache. Avoid using shared or world-writable cache directories.

Disable caching if possible or switch to safer serialization methods like numpy.savez_compressed or torch.save(..., weights_only=True). Monitor for suspicious activity in cache directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100841. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart