CVE-2026-100841 Project-MONAI CVE debrief

Who should care

System administrators and users of MONAI 1.6.0, particularly those with shared or world-writable cache directories, should assess their exposure and take remediation steps. This includes verifying cache directory permissions, restricting access if necessary, and considering an upgrade to a patched version when available. Users should also review their MONAI deployment for potential vulnerabilities and monitor cache directories for suspicious activity.

Why it matters

CVE-2026-100841 allows a local user to execute arbitrary code in another user's context via a malicious pickle file in a shared MONAI cache directory. System administrators and MONAI users should assess their exposure, verify cache directory permissions, and consider upgrading to a patched version when available.

• Arbitrary code execution in user context via deserialization of malicious pickle files.
• Potential for lateral movement and privilege escalation.
• Requires verification of cache directory permissions and user access controls.
• Remediation priority due to high CVSS score and potential for exploitation.

Technical summary

The MONAI 1.6.0 PersistentDataset implementation allows a local user with write access to a shared or world-writable cache directory to place a malicious pickle file. When another user's MONAI pipeline reads the cache, the malicious pickle file is deserialized, leading to arbitrary code execution in that user's context. This vulnerability is due to the explicit rejection of the combination track_meta=True with weights_only=True, forcing users to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/utils.py also call pickle.loads on cached content and derive cache keys with hashlib.md5.

Defensive priority

High-priority assessment and remediation recommended for systems using MONAI 1.6.0 with shared or world-writable cache directories.

Recommended defensive actions

• Assess MONAI 1.6.0 deployment for shared or world-writable cache directories.
• Verify cache directory permissions and restrict access if necessary.
• Consider upgrading to a patched version of MONAI when available.
• Monitor cache directory for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in MONAI 1.6.0. The vulnerability allows a local user to execute arbitrary code in another user's context via a malicious pickle file in a shared cache directory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.