CVE-2026-69112: Accelerate path traversal

Q: Is CVE-2026-69112 actively exploited?

No confirmed active exploitation of CVE-2026-69112 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-69112?

1) Upgrade Accelerate to the patched release incorporating the fixes from PR #4070 and #4138 (verify against current stable, since the affected range is 'through 1.14.0'). 2) Until patched, add an application-level check that resolves each weight_map path against the checkpoint directory and rejects any entry that escapes it (block ../, absolute paths, and non-regular-file targets like named pipes/FIFOs) before calling load_checkpoint_in_model/load_checkpoint_and_dispatch. 3) Treat third-party checkpoints as untrusted input — only load sharded checkpoints from pinned/verified Hugging Face Hub revisions or internally-signed artifact stores, not ad hoc downloads. 4) For detection, monitor for checkpoint-loading calls that hang unexpectedly (possible named-pipe DoS) and for file-access patterns outside the expected checkpoint directory in audit/file-integrity logs. 5) Run checkpoint-loading from unverified sources in a sandboxed, least-privilege environment with no access to SSH keys, cloud credentials, or other sensitive files, since impact is scoped to whatever the process account can read.

Q: What systems are affected by CVE-2026-69112?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, fine-tuning workflows, distributed/sharded model serving, model checkpoint loading.

Q: What is the CVSS score for CVE-2026-69112?

CVE-2026-69112 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.19%.

CISO Take

Hugging Face Accelerate's checkpoint-loading functions (load_checkpoint_in_model and load_checkpoint_and_dispatch) trust the weight_map entries inside a sharded checkpoint index without sanitizing them, so a crafted index with ../ sequences, absolute paths, or named-pipe references lets an attacker read arbitrary files off the host or hang the loading process indefinitely. This matters anywhere Accelerate loads third-party or shared model checkpoints — routine in fine-tuning and distributed training/inference pipelines — because the attack surface is any checkpoint a team downloads from a hub, teammate, or CI artifact store, not just code the team wrote. Exploitation likelihood is currently low: EPSS sits at 0.15%, the CVE is not in CISA's KEV catalog, CISA's SSVC decision is TRACK* (lowest urgency, monitor only), and no public exploit or Nuclei template exists yet — but the CVSS 7.1 score (C:H/A:H) reflects real confidentiality and availability impact once a malicious checkpoint is loaded, since a local UI:R vector means the realistic trigger is a developer or pipeline unknowingly loading a poisoned checkpoint that reads credential files or silently DoSes a training job via a named pipe. Patch to the Accelerate release incorporating fixes from PR #4070/#4138, and until then treat every third-party sharded checkpoint index as untrusted input by validating weight_map paths resolve inside the expected checkpoint directory before loading.

Sources: NVD EPSS GitHub Advisory ATLAS CISA ADP (SSVC) vulncheck.com

What is the risk?

Risk is MODERATE, not critical. The vulnerability requires user interaction — a developer or automated pipeline must load an attacker-controlled checkpoint index — and the CVSS vector (AV:L/AC:L/PR:N/UI:R) means it cannot be triggered remotely without that precondition, though it is a realistic one given how common it is to download pretrained or fine-tuned checkpoints from hubs, forums, or shared storage. Impact once triggered is high (C:H/A:H): arbitrary file read can expose credentials, API keys, SSH keys, or proprietary data, and named-pipe shard entries can hang the process indefinitely, disrupting training/inference availability. Exploitation signals remain low — EPSS 0.15%, not KEV-listed, SSVC TRACK*, no public PoC or scanner coverage — making this a patch-and-move-on issue rather than an emergency, but any organization loading Accelerate-based checkpoints from external sources should treat it as a genuine supply-chain trust-boundary gap.

How does the attack unfold?

Malicious checkpoint distribution

Attacker publishes or hands off a sharded checkpoint whose index file contains weight_map entries with ../ traversal sequences, absolute paths, or named-pipe references.

AML.T0058

Victim loads checkpoint

A developer or automated pipeline calls load_checkpoint_in_model or load_checkpoint_and_dispatch against the attacker-supplied checkpoint as part of normal fine-tuning or deployment work.

AML.T0011.000

Path traversal exploitation

Accelerate resolves the unsanitized weight_map path and reads the attacker-specified file (e.g., SSH keys, .env, cloud credentials) directly into the loading process.

AML.T0037

Impact: data exposure or DoS

The victim suffers confidentiality loss if file contents are exposed via logs/errors/output, or an availability loss if a named-pipe entry causes the load call to hang the training/inference job indefinitely.

Malicious checkpoint distribution

Attacker publishes or hands off a sharded checkpoint whose index file contains weight_map entries with ../ traversal sequences, absolute paths, or named-pipe references.

AML.T0058

Victim loads checkpoint

A developer or automated pipeline calls load_checkpoint_in_model or load_checkpoint_and_dispatch against the attacker-supplied checkpoint as part of normal fine-tuning or deployment work.

AML.T0011.000

Path traversal exploitation

Accelerate resolves the unsanitized weight_map path and reads the attacker-specified file (e.g., SSH keys, .env, cloud credentials) directly into the loading process.

AML.T0037

Impact: data exposure or DoS

The victim suffers confidentiality loss if file contents are exposed via logs/errors/output, or an availability loss if a named-pipe entry causes the load call to hang the training/inference job indefinitely.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Accelerate	pip	<= 1.14.0	No patch
9.9K OpenSSF 6.5 3.0K dependents Pushed 6d ago 0% patched Full package profile →

Do you use Accelerate? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 8% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C High

I None

A High

What should I do?

1 step

1) Upgrade Accelerate to the patched release incorporating the fixes from PR #4070 and #4138 (verify against current stable, since the affected range is 'through 1.14.0'). 2) Until patched, add an application-level check that resolves each weight_map path against the checkpoint directory and rejects any entry that escapes it (block ../, absolute paths, and non-regular-file targets like named pipes/FIFOs) before calling load_checkpoint_in_model/load_checkpoint_and_dispatch. 3) Treat third-party checkpoints as untrusted input — only load sharded checkpoints from pinned/verified Hugging Face Hub revisions or internally-signed artifact stores, not ad hoc downloads. 4) For detection, monitor for checkpoint-loading calls that hang unexpectedly (possible named-pipe DoS) and for file-access patterns outside the expected checkpoint directory in audit/file-integrity logs. 5) Run checkpoint-loading from unverified sources in a sandboxed, least-privilege environment with no access to SSH keys, cloud credentials, or other sensitive files, since impact is scoped to whatever the process account can read.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage DoS Supply Chain Framework Model AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0037 - Data from Local System

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.6 - Data for AI systems

NIST AI RMF

MANAGE-4.1 - Risk treatment for third-party/supply-chain risks

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-69112?

Hugging Face Accelerate's checkpoint-loading functions (load_checkpoint_in_model and load_checkpoint_and_dispatch) trust the weight_map entries inside a sharded checkpoint index without sanitizing them, so a crafted index with ../ sequences, absolute paths, or named-pipe references lets an attacker read arbitrary files off the host or hang the loading process indefinitely. This matters anywhere Accelerate loads third-party or shared model checkpoints — routine in fine-tuning and distributed training/inference pipelines — because the attack surface is any checkpoint a team downloads from a hub, teammate, or CI artifact store, not just code the team wrote. Exploitation likelihood is currently low: EPSS sits at 0.15%, the CVE is not in CISA's KEV catalog, CISA's SSVC decision is TRACK* (lowest urgency, monitor only), and no public exploit or Nuclei template exists yet — but the CVSS 7.1 score (C:H/A:H) reflects real confidentiality and availability impact once a malicious checkpoint is loaded, since a local UI:R vector means the realistic trigger is a developer or pipeline unknowingly loading a poisoned checkpoint that reads credential files or silently DoSes a training job via a named pipe. Patch to the Accelerate release incorporating fixes from PR #4070/#4138, and until then treat every third-party sharded checkpoint index as untrusted input by validating weight_map paths resolve inside the expected checkpoint directory before loading.

Is CVE-2026-69112 actively exploited?

No confirmed active exploitation of CVE-2026-69112 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69112?

1) Upgrade Accelerate to the patched release incorporating the fixes from PR #4070 and #4138 (verify against current stable, since the affected range is 'through 1.14.0'). 2) Until patched, add an application-level check that resolves each weight_map path against the checkpoint directory and rejects any entry that escapes it (block ../, absolute paths, and non-regular-file targets like named pipes/FIFOs) before calling load_checkpoint_in_model/load_checkpoint_and_dispatch. 3) Treat third-party checkpoints as untrusted input — only load sharded checkpoints from pinned/verified Hugging Face Hub revisions or internally-signed artifact stores, not ad hoc downloads. 4) For detection, monitor for checkpoint-loading calls that hang unexpectedly (possible named-pipe DoS) and for file-access patterns outside the expected checkpoint directory in audit/file-integrity logs. 5) Run checkpoint-loading from unverified sources in a sandboxed, least-privilege environment with no access to SSH keys, cloud credentials, or other sensitive files, since impact is scoped to whatever the process account can read.

What systems are affected by CVE-2026-69112?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, fine-tuning workflows, distributed/sharded model serving, model checkpoint loading.

What is the CVSS score for CVE-2026-69112?

CVE-2026-69112 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

training pipelinesfine-tuning workflowsdistributed/sharded model servingmodel checkpoint loading

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0037 Data from Local System

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.

Exploitation Scenario

An attacker publishes a fine-tuned model on a public hub (or sends it directly to a target team) whose sharded checkpoint index has a weight_map entry pointing to '../../../../home/mluser/.ssh/id_rsa' instead of a real shard filename. A data scientist on the victim team downloads the checkpoint to resume fine-tuning and calls load_checkpoint_and_dispatch() as part of their normal workflow. Accelerate resolves the path without sanitization and reads the attacker-specified file directly into the loading process — if error handling surfaces file contents, logs them, or the bytes get treated as tensor data and later re-exported, the attacker gains a path to exfiltrate credentials or secrets from the host. Alternatively, the attacker points a shard entry at a named pipe (FIFO) that nothing is writing to, causing the load call to block forever and quietly hang the victim's training job or CI pipeline — a low-effort denial of service requiring no special access, just the victim opening the malicious checkpoint.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.