CVE-2026-119578: MONAI code execution

CISO Take

MONAI 1.6.0 (before 1.6.1) has a code execution flaw in Auto3DSeg. Its algo_from_json() function imports and instantiates whatever Python module and _target_ name a work directory's algo_object.json points to. Anyone who gets a victim to run AutoRunner or import_bundle_algo_history on a booby-trapped directory gets code running as that user, with no extra configuration needed. Urgency is moderate: the CVSS is 7.8 and the attack is local and needs user interaction. It is not in CISA KEV, no public exploit or Nuclei template is known, and there is no EPSS data yet. Exposure is concentrated in medical imaging research and ML engineering teams that exchange Auto3DSeg work directories, where the executing account often holds patient-data access, GPU hosts, and cloud credentials. Upgrade to MONAI 1.6.1 or later, and until then treat any work directory or algorithm bundle from outside your organization as untrusted code.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

High severity (CVSS 7.8) but with limited reach. The attack is local, needs no privileges, and has low complexity, but a user must load the crafted directory. There is no KEV listing, no known public exploit, and no EPSS score, so near-term mass exploitation looks unlikely. The practical risk comes from how often Auto3DSeg work directories and algorithm bundles are shared between researchers, collaborators, and automated pipelines. In those settings the victim's own privileges (data access, GPU nodes, credentials) become the attacker's. Confidence is MEDIUM because downstream dependent counts and exploitation telemetry are unavailable.

How does the attack unfold?

Artifact staging

Attacker crafts a work directory with a malicious algorithm_templates module and an algo_object.json whose _target_ points to it.

AML.T0010.001

User execution

Victim loads the directory via AutoRunner or import_bundle_algo_history, triggering algo_from_json().

AML.T0011.000

Code execution

MONAI imports and instantiates the attacker-controlled class, running arbitrary Python under default configuration.

AML.T0050

Impact

Attacker steals datasets, model weights, and credentials, or tampers with models on the compromised host.

Artifact staging

Attacker crafts a work directory with a malicious algorithm_templates module and an algo_object.json whose _target_ points to it.

AML.T0010.001

User execution

Victim loads the directory via AutoRunner or import_bundle_algo_history, triggering algo_from_json().

AML.T0011.000

Code execution

MONAI imports and instantiates the attacker-controlled class, running arbitrary Python under default configuration.

AML.T0050

Impact

Attacker steals datasets, model weights, and credentials, or tampers with models on the compromised host.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MONAI	pip	—	No patch
8.8KOpenSSF 7.9128 dependentsPushed 7d ago41% patched~21d to patchFull package profile →

Do you use MONAI? You're affected.

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVLocal

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade MONAI to 1.6.1 or later (see GHSA-2wx3-8x3w-r8qv). 2) Until patched, do not call AutoRunner or import_bundle_algo_history on work directories from untrusted or unverified sources. Verify provenance and integrity (hashes or signatures) of shared directories. 3) Review algo_object.json files for unexpected _target_ values and for algorithm_templates modules that do not match the official MONAI templates. 4) Run Auto3DSeg jobs in sandboxed containers or low-privilege accounts with no access to production data or long-lived credentials. 5) Detection: monitor for unexpected child processes, network connections, or file writes from Python training jobs, and inventory hosts running MONAI 1.6.0 with SCA tooling.

How is it classified?

Code ExecutionSupply ChainFrameworkTraining DataAML.T0010.001- AI Software AML.T0011.000- Unsafe AI Artifacts AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies and procedures address third-party AI risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-119578?

MONAI 1.6.0 (before 1.6.1) has a code execution flaw in Auto3DSeg. Its algo_from_json() function imports and instantiates whatever Python module and _target_ name a work directory's algo_object.json points to. Anyone who gets a victim to run AutoRunner or import_bundle_algo_history on a booby-trapped directory gets code running as that user, with no extra configuration needed. Urgency is moderate: the CVSS is 7.8 and the attack is local and needs user interaction. It is not in CISA KEV, no public exploit or Nuclei template is known, and there is no EPSS data yet. Exposure is concentrated in medical imaging research and ML engineering teams that exchange Auto3DSeg work directories, where the executing account often holds patient-data access, GPU hosts, and cloud credentials. Upgrade to MONAI 1.6.1 or later, and until then treat any work directory or algorithm bundle from outside your organization as untrusted code.

Is CVE-2026-119578 actively exploited?

No confirmed active exploitation of CVE-2026-119578 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-119578?

1) Upgrade MONAI to 1.6.1 or later (see GHSA-2wx3-8x3w-r8qv). 2) Until patched, do not call AutoRunner or import_bundle_algo_history on work directories from untrusted or unverified sources. Verify provenance and integrity (hashes or signatures) of shared directories. 3) Review algo_object.json files for unexpected _target_ values and for algorithm_templates modules that do not match the official MONAI templates. 4) Run Auto3DSeg jobs in sandboxed containers or low-privilege accounts with no access to production data or long-lived credentials. 5) Detection: monitor for unexpected child processes, network connections, or file writes from Python training jobs, and inventory hosts running MONAI 1.6.0 with SCA tooling.

What systems are affected by CVE-2026-119578?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, AutoML pipelines, medical imaging ML workflows, shared research workstations and GPU clusters.

What is the CVSS score for CVE-2026-119578?

CVE-2026-119578 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.55%.

What is the AI security impact?

Affected AI Architectures

training pipelinesAutoML pipelinesmedical imaging ML workflowsshared research workstations and GPU clusters

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0011.000Unsafe AI Artifacts

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm_templates module plus a _target_ name that is imported and instantiated when victims call AutoRunner or import_bundle_algo_history, executing code under default configuration.

Exploitation Scenario

An attacker publishes a pre-trained Auto3DSeg work directory, for example as a collaborator share, a public repository, or a challenge submission. It contains a malicious algorithm_templates module and an algo_object.json whose _target_ points to it. A researcher or automated pipeline loads the directory with AutoRunner or import_bundle_algo_history to reproduce or resume a segmentation experiment. algo_from_json() imports and instantiates the attacker's class, which runs a payload that steals credentials and imaging datasets and opens a reverse shell on the GPU host.

Weaknesses (CWE)

CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')Primary CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

CWE-470 — Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'): The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

[Architecture and Design] Refactor your code to avoid using reflection.
[Architecture and Design] Do not use user-controlled inputs to select and load classes or code.

Source: MITRE CWE corpus.