CVE-2026-71281: PEFT unsafe torch.load

CISO Take

Hugging Face's peft library, the standard toolkit for LoRA fine-tuning of LLMs, calls torch.load() on cache and covariance files during LoRA-GA and CorDA initialization without weights_only=True, bypassing the safe-loading wrapper peft uses everywhere else in its codebase. Because torch.load can deserialize arbitrary Python objects via pickle, any cache or covariance file an attacker gets a victim to point their fine-tuning job at becomes a remote code execution vector, and the 8.8 CVSS score reflects full compromise of confidentiality, integrity, and availability on whatever host runs the training pipeline. The mitigating factor is that exploitation requires user interaction and CISA's SSVC decision is TRACK rather than Act, with EPSS at just 0.27% and no public exploit or scanner template in the wild, so this is not currently being actively exploited. Teams using peft's LoRA-GA or CorDA initialization should upgrade to a patched release immediately and, until then, only point cache/covariance paths at self-generated or cryptographically verified files, never at artifacts pulled from shared repos, model hubs, or CI pipelines of unknown provenance.

Sources: NVD EPSS ATLAS github.com/huggingface/peft

What is the risk?

High severity (CVSS 8.8) but currently low urgency: attack requires user interaction to load an attacker-controlled cache/covariance file, which caps real-world exploitability relative to a fully unauthenticated RCE. EPSS is low (0.27%, ~80th percentile) and CISA's SSVC decision is TRACK, indicating no evidence of active or imminent exploitation. No public PoC or Nuclei template exists, and the CVE is not in CISA KEV. However, network attack vector, low attack complexity, no privileges required, and full C/I/A impact mean that once a victim is convinced to point a config at a malicious file, compromise is complete and trivial to execute. Risk is elevated for any organization that shares or downloads LoRA-GA/CorDA cache artifacts from community sources, model hubs, or collaborative training pipelines.

How does the attack unfold?

Stage capability

Attacker crafts a malicious pickle file disguised as a LoRA-GA/CorDA covariance cache and publishes it via a shared repo, model hub, or fine-tuning tutorial.

AML.T0011.000

Delivery

Victim configures a peft fine-tuning job (manually or via CI/CD) to load the attacker-controlled cache/covariance file.

AML.T0010.001

Exploitation

peft calls torch.load() on the file without weights_only=True during LoRA-GA/CorDA initialization, deserializing the pickle payload.

AML.T0011

Impact

Arbitrary code executes with the training process's privileges, enabling data exfiltration, model poisoning, or lateral movement into ML infrastructure.

AML.T0112.001

Stage capability

Attacker crafts a malicious pickle file disguised as a LoRA-GA/CorDA covariance cache and publishes it via a shared repo, model hub, or fine-tuning tutorial.

AML.T0011.000

Delivery

Victim configures a peft fine-tuning job (manually or via CI/CD) to load the attacker-controlled cache/covariance file.

AML.T0010.001

Exploitation

peft calls torch.load() on the file without weights_only=True during LoRA-GA/CorDA initialization, deserializing the pickle payload.

AML.T0011

Impact

Arbitrary code executes with the training process's privileges, enabling data exfiltration, model poisoning, or lateral movement into ML infrastructure.

AML.T0112.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PEFT	pip	—	No patch
21.7K 744 dependents Pushed 3d ago 0% patched Full package profile →

Do you use PEFT? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade peft to a patched release that enforces weights_only=True (or the library's standard safe-loading wrapper) in corda.py and loraga.py. 2) Until patched, never point LoRA-GA/CorDA cache_file or covariance_file config paths at files from untrusted sources — treat them with the same suspicion as pickled model weights. 3) Prefer regenerating cache/covariance files locally rather than downloading precomputed ones. 4) Where sharing is necessary, distribute cache data in a non-pickle format (e.g., safetensors) if peft/downstream tooling supports it. 5) Detection: monitor training hosts for anomalous subprocess spawns or network connections originating from Python processes running peft fine-tuning jobs, and audit CI pipelines for unpinned/external cache file sources.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Framework Training Data AML.T0002 - Acquire Public AI Artifacts AML.T0010.001 - AI Software AML.T0011 - User Execution AML.T0011.000 - Unsafe AI Artifacts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.7.2 - Data acquisition

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-71281?

Hugging Face's peft library, the standard toolkit for LoRA fine-tuning of LLMs, calls torch.load() on cache and covariance files during LoRA-GA and CorDA initialization without weights_only=True, bypassing the safe-loading wrapper peft uses everywhere else in its codebase. Because torch.load can deserialize arbitrary Python objects via pickle, any cache or covariance file an attacker gets a victim to point their fine-tuning job at becomes a remote code execution vector, and the 8.8 CVSS score reflects full compromise of confidentiality, integrity, and availability on whatever host runs the training pipeline. The mitigating factor is that exploitation requires user interaction and CISA's SSVC decision is TRACK rather than Act, with EPSS at just 0.27% and no public exploit or scanner template in the wild, so this is not currently being actively exploited. Teams using peft's LoRA-GA or CorDA initialization should upgrade to a patched release immediately and, until then, only point cache/covariance paths at self-generated or cryptographically verified files, never at artifacts pulled from shared repos, model hubs, or CI pipelines of unknown provenance.

Is CVE-2026-71281 actively exploited?

No confirmed active exploitation of CVE-2026-71281 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-71281?

1) Upgrade peft to a patched release that enforces weights_only=True (or the library's standard safe-loading wrapper) in corda.py and loraga.py. 2) Until patched, never point LoRA-GA/CorDA cache_file or covariance_file config paths at files from untrusted sources — treat them with the same suspicion as pickled model weights. 3) Prefer regenerating cache/covariance files locally rather than downloading precomputed ones. 4) Where sharing is necessary, distribute cache data in a non-pickle format (e.g., safetensors) if peft/downstream tooling supports it. 5) Detection: monitor training hosts for anomalous subprocess spawns or network connections originating from Python processes running peft fine-tuning jobs, and audit CI pipelines for unpinned/external cache file sources.

What systems are affected by CVE-2026-71281?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, fine-tuning pipelines, agent frameworks.

What is the CVSS score for CVE-2026-71281?

CVE-2026-71281 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

training pipelinesfine-tuning pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0002 Acquire Public AI Artifacts

AML.T0010.001 AI Software

AML.T0011 User Execution

AML.T0011.000 Unsafe AI Artifacts

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load on config-specified cache/covariance files without weights_only=True, bypassing peft's own safe-loading wrapper used elsewhere in the codebase.

Exploitation Scenario

An attacker crafts a malicious pickle file disguised as a LoRA-GA or CorDA covariance cache and publishes it on a public model hub, GitHub repo, or shared dataset alongside a legitimate-looking fine-tuning recipe. A victim, following a tutorial or reusing a shared config, points their peft fine-tuning job's cache_file/covariance_file parameter at the attacker's file — either directly or via an automated CI/CD training pipeline that pulls artifacts from an external source. When the fine-tuning job initializes LoRA-GA or CorDA, peft calls torch.load() on the file without weights_only=True, and the pickle payload executes arbitrary code with the privileges of the training process — potentially exfiltrating training data or credentials, poisoning the resulting model, or pivoting further into the ML infrastructure.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.