CVE-2026-62997: unsafe torch.load enables RCE

Q: Is CVE-2026-62997 actively exploited?

No confirmed active exploitation of CVE-2026-62997 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-62997?

1) Upgrade kedro-datasets to 9.5.0 or later (the fixed release per the project advisory). 2) Upgrade PyTorch to 2.6 or later so weights_only=True is the default for torch.load. 3) Identify usage by searching code and catalog YAML for PyTorchDataset or kedro_datasets_experimental.pytorch. 4) Restrict model sources to trusted, access-controlled registries, and verify hashes or signatures before loading. 5) Scan .pt files with picklescan or fickling and prefer safetensors where possible. 6) Run pipelines with least-privilege credentials, in sandboxed or network-restricted workers. 7) Monitor for unexpected child processes or outbound connections from Kedro runs.

Q: What systems are affected by CVE-2026-62997?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, batch inference pipelines, ML data pipelines, model registries and artifact stores.

Q: What is the CVSS score for CVE-2026-62997?

No CVSS score has been assigned yet.

CISO Take

Kedro-Datasets' experimental PyTorchDataset loads .pt files with torch.load without enforcing weights_only=True, and silently ignores user-supplied load_args, so a malicious pickle-backed model can execute arbitrary code when a pipeline loads it (CWE-502). Exploitation requires the attacker to get a poisoned model into a shared registry, downloaded checkpoint, or partitioned external source, and it only works on PyTorch versions earlier than 2.6 where weights_only is not the default. Exposure is limited to the opt-in kedro_datasets_experimental component. EPSS is low (0.00686, around the 49th percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC says TRACK. Inventory Kedro pipelines that use PyTorchDataset, upgrade kedro-datasets to 9.5.0 (the fixed release per the advisory), and move to PyTorch 2.6 or later. Until then, load only models from trusted, integrity-verified sources.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Moderate and conditional. Impact is arbitrary code execution in the pipeline's runtime, which often holds data-lake, cloud, and credential access. Exploitation needs an attacker-influenced model source and a vulnerable PyTorch version (<2.6). No CVSS score is published. Exploitation likelihood is low-to-moderate (EPSS 0.00686, no known exploit, not in KEV, SSVC TRACK). Organizations that pull checkpoints from shared or external registries face the highest exposure.

How does the attack unfold?

Artifact Poisoning

Attacker plants a malicious pickle-backed .pt model in a shared registry, checkpoint download, or external partitioned source.

AML.T0058

Pipeline Load

A Kedro pipeline using PyTorchDataset calls torch.load without weights_only=True, because load_args are silently dropped.

AML.T0011.000

Code Execution

Unpickling runs the embedded payload on a host with PyTorch earlier than 2.6, giving the attacker code execution.

AML.T0018.002

Impact

Attacker steals credentials and data or tampers with downstream models and pipelines.

AML.T0112.001

Artifact Poisoning

Attacker plants a malicious pickle-backed .pt model in a shared registry, checkpoint download, or external partitioned source.

AML.T0058

Pipeline Load

A Kedro pipeline using PyTorchDataset calls torch.load without weights_only=True, because load_args are silently dropped.

AML.T0011.000

Code Execution

Unpickling runs the embedded payload on a host with PyTorch earlier than 2.6, giving the attacker code execution.

AML.T0018.002

Impact

Attacker steals credentials and data or tampers with downstream models and pipelines.

AML.T0112.001

How severe is it?

CVSS 3.1

N/A

EPSS

0.7%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Upgrade kedro-datasets to 9.5.0 or later (the fixed release per the project advisory). 2) Upgrade PyTorch to 2.6 or later so weights_only=True is the default for torch.load. 3) Identify usage by searching code and catalog YAML for PyTorchDataset or kedro_datasets_experimental.pytorch. 4) Restrict model sources to trusted, access-controlled registries, and verify hashes or signatures before loading. 5) Scan .pt files with picklescan or fickling and prefer safetensors where possible. 6) Run pipelines with least-privilege credentials, in sandboxed or network-restricted workers. 7) Monitor for unexpected child processes or outbound connections from Kedro runs.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainModel PoisoningFrameworkModelTraining DataAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0018.002- Embed Malware AML.T0058- Publish Poisoned Models AML.T0112.001- AI Artifacts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Third-party AI risk policies

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-62997?

Kedro-Datasets' experimental PyTorchDataset loads .pt files with torch.load without enforcing weights_only=True, and silently ignores user-supplied load_args, so a malicious pickle-backed model can execute arbitrary code when a pipeline loads it (CWE-502). Exploitation requires the attacker to get a poisoned model into a shared registry, downloaded checkpoint, or partitioned external source, and it only works on PyTorch versions earlier than 2.6 where weights_only is not the default. Exposure is limited to the opt-in kedro_datasets_experimental component. EPSS is low (0.00686, around the 49th percentile), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC says TRACK. Inventory Kedro pipelines that use PyTorchDataset, upgrade kedro-datasets to 9.5.0 (the fixed release per the advisory), and move to PyTorch 2.6 or later. Until then, load only models from trusted, integrity-verified sources.

Is CVE-2026-62997 actively exploited?

No confirmed active exploitation of CVE-2026-62997 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62997?

1) Upgrade kedro-datasets to 9.5.0 or later (the fixed release per the project advisory). 2) Upgrade PyTorch to 2.6 or later so weights_only=True is the default for torch.load. 3) Identify usage by searching code and catalog YAML for PyTorchDataset or kedro_datasets_experimental.pytorch. 4) Restrict model sources to trusted, access-controlled registries, and verify hashes or signatures before loading. 5) Scan .pt files with picklescan or fickling and prefer safetensors where possible. 6) Run pipelines with least-privilege credentials, in sandboxed or network-restricted workers. 7) Monitor for unexpected child processes or outbound connections from Kedro runs.

What systems are affected by CVE-2026-62997?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, batch inference pipelines, ML data pipelines, model registries and artifact stores.

What is the CVSS score for CVE-2026-62997?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

training pipelinesbatch inference pipelinesML data pipelinesmodel registries and artifact stores

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0018.002Embed Malware

AML.T0058Publish Poisoned Models

AML.T0112.001AI Artifacts

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, downloaded checkpoint, or partitioned external source can execute arbitrary code when a Kedro pipeline loads it. The issue affects only the opt-in kedro_datasets_experimental component and does not affect users who load only trusted files. This issue is fixed in version 9.5.0.

Exploitation Scenario

An attacker publishes or tampers with a PyTorch checkpoint, crafted with a malicious pickle payload, in a shared model registry or a partitioned external storage location that a data science team's Kedro pipeline reads. The pipeline's catalog entry uses PyTorchDataset on an environment with PyTorch earlier than 2.6. When the node runs, torch.load unpickles the file and executes the payload. The attacker gets a shell on the worker, steals cloud credentials and data, and may tamper with downstream models.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.