CVE-2026-109361: MONAI insecure pickle

CISO Take

MONAI's nnUNetV2Runner loads a postprocessing file path from inference_information.json and unpickles it without confining it to the results directory, so anyone who can edit that JSON can run arbitrary code when predict_ensemble_postprocessing executes. Exploitation needs local access, low privileges and a user action, and no public exploit, Nuclei template, KEV listing or EPSS score exists yet, so near-term mass exploitation is unlikely. The exposure is mainly shared medical-imaging research and training environments, where multiple users or automated pipelines write to common results directories, and the package has 127 downstream dependents plus 16 other CVEs, which points to a recurring deserialization problem class. Upgrade MONAI to 1.6.1 or later, and until then restrict write access to nnU-Net results directories and treat inference_information.json as untrusted input.

Sources:NVDGitHub AdvisoryVulnCheckATLASOpenSSF

What is the risk?

Rated high (CVSS 7.3). The attack is local with low complexity and low privileges, but it requires user interaction, so the realistic risk is insider or shared-workspace abuse and poisoned project artifacts rather than internet-scale attacks. If it succeeds, confidentiality, integrity and availability are all fully compromised in the context of the user running the pipeline, which often has GPU hosts, PHI-bearing datasets and cloud credentials. Exploitation likelihood is currently low: no EPSS score, no public exploit and no KEV entry. The fix is a small patch that is easy to reverse-engineer, which raises the chance of weaponization over time.

How does the attack unfold?

Initial Access

Attacker with low-privilege local access or a poisoned results bundle modifies inference_information.json to reference a malicious pickle.

AML.T0010.001

Execution

A user or job runs predict_ensemble_postprocessing, and nnUNetV2Runner unpickles the attacker-controlled postprocessing file.

AML.T0011.000

Impact

Arbitrary code runs with the pipeline user's privileges, exposing imaging data, model weights and credentials and enabling lateral movement.

AML.T0112.001

Initial Access

Attacker with low-privilege local access or a poisoned results bundle modifies inference_information.json to reference a malicious pickle.

AML.T0010.001

Execution

A user or job runs predict_ensemble_postprocessing, and nnUNetV2Runner unpickles the attacker-controlled postprocessing file.

AML.T0011.000

Impact

Arbitrary code runs with the pipeline user's privileges, exposing imaging data, model weights and credentials and enabling lateral movement.

AML.T0112.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MONAI	pip	—	No patch
8.8KOpenSSF 7.9128 dependentsPushed 7d ago41% patched~21d to patchFull package profile →

Do you use MONAI? You're affected.

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACLow

PRLow

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade MONAI to 1.6.1 or later (see commit 08576205 and GHSA-8f32-8649-rv87). 2) Until patched, avoid predict_ensemble_postprocessing on untrusted results directories and lock write permissions on inference_information.json and the results directory to the trusted pipeline account. 3) Do not import nnU-Net result bundles or experiment folders from untrusted sources without inspecting them. 4) Inventory MONAI versions with SBOM or pip audit tooling across notebooks, containers and HPC environments. 5) Detect by monitoring for unexpected edits to inference_information.json, postprocessing_file values pointing outside the results directory, and child processes spawned by Python training or inference jobs. 6) Run pipelines in least-privilege, network-restricted containers and scan pickle files with tools like picklescan or fickling.

How is it classified?

Code ExecutionSupply ChainFrameworkModelTraining DataAML.T0010.001- AI Software AML.T0011.000- Unsafe AI Artifacts AML.T0018.002- Embed Malware

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks are managed

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-109361?

MONAI's nnUNetV2Runner loads a postprocessing file path from inference_information.json and unpickles it without confining it to the results directory, so anyone who can edit that JSON can run arbitrary code when predict_ensemble_postprocessing executes. Exploitation needs local access, low privileges and a user action, and no public exploit, Nuclei template, KEV listing or EPSS score exists yet, so near-term mass exploitation is unlikely. The exposure is mainly shared medical-imaging research and training environments, where multiple users or automated pipelines write to common results directories, and the package has 127 downstream dependents plus 16 other CVEs, which points to a recurring deserialization problem class. Upgrade MONAI to 1.6.1 or later, and until then restrict write access to nnU-Net results directories and treat inference_information.json as untrusted input.

Is CVE-2026-109361 actively exploited?

No confirmed active exploitation of CVE-2026-109361 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109361?

1) Upgrade MONAI to 1.6.1 or later (see commit 08576205 and GHSA-8f32-8649-rv87). 2) Until patched, avoid predict_ensemble_postprocessing on untrusted results directories and lock write permissions on inference_information.json and the results directory to the trusted pipeline account. 3) Do not import nnU-Net result bundles or experiment folders from untrusted sources without inspecting them. 4) Inventory MONAI versions with SBOM or pip audit tooling across notebooks, containers and HPC environments. 5) Detect by monitoring for unexpected edits to inference_information.json, postprocessing_file values pointing outside the results directory, and child processes spawned by Python training or inference jobs. 6) Run pipelines in least-privilege, network-restricted containers and scan pickle files with tools like picklescan or fickling.

What systems are affected by CVE-2026-109361?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving, medical imaging inference pipelines, shared research and notebook environments.

What is the CVSS score for CVE-2026-109361?

CVE-2026-109361 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel servingmedical imaging inference pipelinesshared research and notebook environments

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0011.000Unsafe AI Artifacts

AML.T0018.002Embed Malware

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs.

Exploitation Scenario

An attacker with low-privilege access to a shared research server, or who delivers a poisoned nnU-Net results folder to a collaborator, edits inference_information.json so postprocessing_file points to a malicious pickle placed elsewhere on the filesystem. When a researcher or scheduled job runs predict_ensemble_postprocessing, MONAI unpickles the file and the payload executes under that user's account. The attacker can then steal imaging datasets, model weights and cloud credentials, or pivot to other hosts in the research environment.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.