CVE-2026-118684: MONAI: missing hash check allows tampered model downloads

MEDIUM

Published October 28, 2026

CISO Take

MONAI before 1.6.1 has a flaw in check_hash() that silently reports success when no hash value is supplied, and it defaults to MD5 when one is. Any bundle, dataset, or model archive downloaded without an explicit hash is therefore never integrity-checked, so a man-in-the-middle or a compromised registry can swap in malicious files. The CVSS score is a moderate 5.9 because the attack needs a privileged network position (high complexity), but the impact is integrity loss that could lead to code execution when tampered model archives are loaded. There is no public exploit, no Nuclei template, and no KEV listing, and EPSS data is unavailable, so near-term exploitation looks unlikely, though MONAI is widely used in medical imaging pipelines where model provenance matters. Upgrade to MONAI 1.6.1 or later, and pin SHA-256 hashes for every artifact your pipelines download.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium overall. Exploitation requires a MitM position or a compromised registry or mirror, which raises attack complexity, and there is no known public exploit or active exploitation. Integrity impact is high because an attacker can substitute artifacts and potentially reach code execution if unsafe formats (such as pickle-based checkpoints) are loaded. Exposure is greatest in automated pipelines that fetch bundles, datasets, or models at runtime without pinned hashes, and in healthcare or research environments where artifacts are trusted implicitly. Exposure of the AI/ML system is mainly through the supply chain rather than direct network attack.

How does the attack unfold?

Initial Access

Attacker gains a MitM position or compromises a registry or mirror serving MONAI bundles, datasets, or model archives.

AML.T0010.003

Artifact Substitution

Victim downloads an artifact without a hash, and check_hash() returns True, so the swapped file is accepted.

AML.T0010.002

Execution

The pipeline loads the malicious model or data, triggering embedded code execution.

AML.T0011.000

Impact

Compromised training or inference hosts and manipulated model outputs undermine integrity of clinical AI results.

AML.T0018.000

Initial Access

Attacker gains a MitM position or compromises a registry or mirror serving MONAI bundles, datasets, or model archives.

AML.T0010.003

Artifact Substitution

Victim downloads an artifact without a hash, and check_hash() returns True, so the swapped file is accepted.

AML.T0010.002

Execution

The pipeline loads the malicious model or data, triggering embedded code execution.

AML.T0011.000

Impact

Compromised training or inference hosts and manipulated model outputs undermine integrity of clinical AI results.

AML.T0018.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MONAI	pip	—	No patch
8.8KOpenSSF 7.9128 dependentsPushed 7d ago41% patched~21d to patchFull package profile →

Do you use MONAI? You're affected.

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 8% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CNone

IHigh

ANone

What should I do?

1 step

1) Upgrade MONAI to 1.6.1 or later. 2) Always pass an explicit hash_val and prefer SHA-256 over the MD5 default for every bundle, dataset, and model download. 3) Mirror approved artifacts into an internal registry and verify checksums or signatures before use. 4) Enforce TLS with certificate validation and restrict egress to trusted hosts for download steps. 5) Avoid loading pickle-based checkpoints from untrusted sources; prefer safetensors and scan artifacts. 6) Audit code for monai.apps.download_url, download_and_extract, and bundle download calls that omit hash_val, and monitor for unexpected artifact hash changes.

How is it classified?

Supply ChainCode ExecutionModel PoisoningFrameworkModelTraining DataAML.T0010.001- AI Software AML.T0010.002- Data AML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0018.002- Embed Malware

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies for third-party AI risk and supply chain

OWASP LLM Top 10

LLM03-Supply ChainLLM04-Data and Model Poisoning

Frequently Asked Questions

What is CVE-2026-118684?

Is CVE-2026-118684 actively exploited?

No confirmed active exploitation of CVE-2026-118684 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118684?

1) Upgrade MONAI to 1.6.1 or later. 2) Always pass an explicit hash_val and prefer SHA-256 over the MD5 default for every bundle, dataset, and model download. 3) Mirror approved artifacts into an internal registry and verify checksums or signatures before use. 4) Enforce TLS with certificate validation and restrict egress to trusted hosts for download steps. 5) Avoid loading pickle-based checkpoints from untrusted sources; prefer safetensors and scan artifacts. 6) Audit code for monai.apps.download_url, download_and_extract, and bundle download calls that omit hash_val, and monitor for unexpected artifact hash changes.

What systems are affected by CVE-2026-118684?

This vulnerability affects the following AI/ML architecture patterns: Training pipelines, Model serving, Model registries and artifact downloads, Medical imaging pipelines, Data ingestion pipelines.

What is the CVSS score for CVE-2026-118684?

CVE-2026-118684 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

Training pipelinesModel servingModel registries and artifact downloadsMedical imaging pipelinesData ingestion pipelines

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0010.002Data

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0018.002Embed Malware

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03, LLM04

What are the technical details?

Original Advisory

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.

Exploitation Scenario

An attacker with a network position between a hospital research cluster and the artifact host, or who compromises a mirror or registry entry, waits for a MONAI pipeline to download a pretrained bundle without a hash. Because check_hash() returns True when hash_val is None, the pipeline accepts the swapped archive. The attacker's bundle carries a malicious payload or a backdoored model. When the pipeline loads it, the payload executes on the training host, or the model produces manipulated predictions in downstream clinical workflows.

Weaknesses (CWE)

CWE-327Use of a Broken or Risky Cryptographic AlgorithmPrimary CWE-327Use of a Broken or Risky Cryptographic Algorithm

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm: The product uses a broken or risky cryptographic algorithm or protocol.

[Architecture and Design] When there is a need to store or transmit sensitive data, use strong, up-to-date cryptographic algorithms to encrypt that data. Select a well-vetted algorithm that is currently considered to be strong by experts in the field, and use well-tested implementations. As with all cryptographic mechanisms, the source code should be available for analysis. For example, US government systems require FIPS 140-2 certification [REF-1192]. Do not develop custom or private cryptographic algorithms. They will likely be exposed to attacks that are well-understood by cryptographers. Reverse engineering techniques are mature. If the algorithm can be compromised if attackers find out how it works, then it is especially weak. Periodically ensure that the cryptography has not become obsolete. Some older algorithms, once thought to require a billion years of computing time, can now be broken in days or hours. This includes MD4, MD5, SHA1, DES, and other algorithms that were once regarded as strong. [REF-267
[Architecture and Design] Ensure that the design allows one cryptographic algorithm to be replaced with another in the next generation or version. Where possible, use wrappers to make the interfaces uniform. This will make it easier to upgrade to stronger algorithms. With hardware, design the product at the Intellectual Property (IP) level so that one cryptographic algorithm can be replaced with another in the next generation of the hardware product.

Source: MITRE CWE corpus.