CVE-2026-68771: unauthenticated RCE

CISO Take

ComfyUI's LoadTrainingDataset node deserializes user-supplied pickle files with torch.load, and because the upload endpoint (POST /upload/image) and the workflow queue endpoint (POST /prompt) both require no authentication, any unauthenticated attacker who can reach a ComfyUI instance can achieve full remote code execution simply by uploading a crafted shard_*.pkl and referencing it in a workflow graph. This is a CVSS 9.8 critical vulnerability with network attack vector, no privileges and no user interaction required — the lowest possible bar for exploitation — and ComfyUI instances are frequently exposed directly to the internet or GPU rental networks without a reverse-proxy auth layer, which materially raises real-world exposure even though EPSS data isn't yet available and it hasn't appeared in CISA KEV or public exploit repositories. No proof-of-concept or Nuclei template is public yet, but pickle deserialization RCEs are trivial to weaponize with widely available tooling, so the absence of a public exploit should not be read as low urgency. Security teams running ComfyUI for image/video generation or training-data pipelines should immediately check whether the fix (GitHub PR #14543 / commit 94ee49b) is applied, restrict /upload/image and /prompt behind authentication or network ACLs, and treat any unexplained process spawned by the ComfyUI service account as a compromise indicator.

Sources: NVD GitHub Advisory VulnCheck ATLAS CISA KEV

What is the risk?

Critical. The combination of CVSS 9.8, zero authentication, zero user interaction, and a well-understood exploitation primitive (Python pickle __reduce__ RCE) puts this at the top of the risk stack for any organization self-hosting ComfyUI. The mitigating factor is exposure timing, not exploitability: this is not currently in CISA KEV, EPSS scoring is unavailable, and no public exploit or Nuclei template exists yet, so internet-wide opportunistic scanning has likely not started at scale. However, ComfyUI is commonly deployed by ML/creative teams on GPU hosts with permissive network rules and no reverse proxy in front, so any organization that exposed an instance directly to the internet or a shared VPC should treat this as urgent regardless of KEV/EPSS status.

How does the attack unfold?

Initial Access

Unauthenticated attacker uploads a crafted shard_*.pkl file to the unauthenticated POST /upload/image endpoint.

AML.T0049

Weaponized Workflow Staging

Attacker queues a workflow graph via POST /prompt referencing a LoadTrainingDataset node that points to the uploaded pickle file.

AML.T0011.000

Execution

ComfyUI calls torch.load on the attacker-controlled pickle, triggering the __reduce__ method and executing arbitrary OS commands as the ComfyUI process user.

AML.T0050

Impact

Attacker achieves full remote code execution, enabling data exfiltration (model weights, credentials), persistence, or lateral movement across the host/GPU infrastructure.

AML.T0112

Initial Access

Unauthenticated attacker uploads a crafted shard_*.pkl file to the unauthenticated POST /upload/image endpoint.

AML.T0049

Weaponized Workflow Staging

Attacker queues a workflow graph via POST /prompt referencing a LoadTrainingDataset node that points to the uploaded pickle file.

AML.T0011.000

Execution

ComfyUI calls torch.load on the attacker-controlled pickle, triggering the __reduce__ method and executing arbitrary OS commands as the ComfyUI process user.

AML.T0050

Impact

Attacker achieves full remote code execution, enabling data exfiltration (model weights, credentials), persistence, or lateral movement across the host/GPU infrastructure.

AML.T0112

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Patch: update to the ComfyUI release containing the fix in PR #14543 / commit 94ee49b, which addresses the unsafe torch.load deserialization in LoadTrainingDataset. Workaround if patching is delayed: never expose ComfyUI's HTTP API directly to the internet — put it behind a reverse proxy with authentication (basic auth, OAuth proxy, or VPN-only access), and restrict /upload/image and /prompt to trusted networks. Detection: monitor for unexpected .pkl uploads (especially shard_*.pkl), unusual child processes spawned by the ComfyUI service account, and unexpected outbound connections from the ComfyUI host. Longer-term: replace pickle-based data loading with safetensors where possible, and scan uploaded artifacts with a tool like picklescan before allowing deserialization.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Training Data Framework AML.T0011.000 - Unsafe AI Artifacts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0112 - Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.2 - Security of the AI system

NIST AI RMF

MANAGE 2.3 - Risks from third-party AI components are managed

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-68771?

ComfyUI's LoadTrainingDataset node deserializes user-supplied pickle files with torch.load, and because the upload endpoint (POST /upload/image) and the workflow queue endpoint (POST /prompt) both require no authentication, any unauthenticated attacker who can reach a ComfyUI instance can achieve full remote code execution simply by uploading a crafted shard_*.pkl and referencing it in a workflow graph. This is a CVSS 9.8 critical vulnerability with network attack vector, no privileges and no user interaction required — the lowest possible bar for exploitation — and ComfyUI instances are frequently exposed directly to the internet or GPU rental networks without a reverse-proxy auth layer, which materially raises real-world exposure even though EPSS data isn't yet available and it hasn't appeared in CISA KEV or public exploit repositories. No proof-of-concept or Nuclei template is public yet, but pickle deserialization RCEs are trivial to weaponize with widely available tooling, so the absence of a public exploit should not be read as low urgency. Security teams running ComfyUI for image/video generation or training-data pipelines should immediately check whether the fix (GitHub PR #14543 / commit 94ee49b) is applied, restrict /upload/image and /prompt behind authentication or network ACLs, and treat any unexplained process spawned by the ComfyUI service account as a compromise indicator.

Is CVE-2026-68771 actively exploited?

No confirmed active exploitation of CVE-2026-68771 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-68771?

Patch: update to the ComfyUI release containing the fix in PR #14543 / commit 94ee49b, which addresses the unsafe torch.load deserialization in LoadTrainingDataset. Workaround if patching is delayed: never expose ComfyUI's HTTP API directly to the internet — put it behind a reverse proxy with authentication (basic auth, OAuth proxy, or VPN-only access), and restrict /upload/image and /prompt to trusted networks. Detection: monitor for unexpected .pkl uploads (especially shard_*.pkl), unusual child processes spawned by the ComfyUI service account, and unexpected outbound connections from the ComfyUI host. Longer-term: replace pickle-based data loading with safetensors where possible, and scan uploaded artifacts with a tool like picklescan before allowing deserialization.

What systems are affected by CVE-2026-68771?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving.

What is the CVSS score for CVE-2026-68771?

CVE-2026-68771 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.78%.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0011.000 Unsafe AI Artifacts

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0112 Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.2

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.

Exploitation Scenario

An attacker scans for internet-facing ComfyUI instances (common on GPU rental marketplaces, homelab setups, and internal ML servers without auth in front of them), then sends a crafted shard_*.pkl file containing a malicious __reduce__ payload to the unauthenticated POST /upload/image endpoint. The attacker then submits a workflow graph via POST /prompt referencing a LoadTrainingDataset node that points at the uploaded file. When ComfyUI processes the queued workflow, it calls torch.load on the attacker's pickle, triggering __reduce__ and executing an arbitrary OS command — for example a reverse shell, or a script that exfiltrates API keys and model weights, installs a cryptominer on the GPU, or pivots to other hosts on the same network.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.