CVE-2026-109361 Project-MONAI CVE debrief

Who should care

Defenders responsible for MONAI deployments should assess exposure and prioritize verification and remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify MONAI versions and configurations, and remediate by upgrading to MONAI 1.6.1 or later. They should also review compensating controls and monitor for suspicious activity.

Why it matters

Defenders should care about CVE-2026-109361 because it allows potential code execution on vulnerable MONAI instances. If attackers can modify inference_information.json, they can point it at a malicious pickle to execute code when predict_ensemble_postprocessing runs. Defenders responsible for MONAI deployments should assess exposure, prioritize verification of MONAI versions and configurations, and remediate by upgrading to MONAI 1.6.1 or later.

• Potential code execution on vulnerable MONAI instances
• Possible lateral movement if attackers can modify inference_information.json
• Verification of MONAI versions and configurations is necessary
• Remediation requires upgrading to MONAI 1.6.1 or later

Technical summary

The MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. This allows attackers who can modify inference_information.json to point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs. The vulnerability affects MONAI deployments and requires verification of versions and configurations to prioritize remediation.

Defensive priority

Defenders should prioritize verifying MONAI versions and upgrading to 1.6.1 or later if vulnerable.

Recommended defensive actions

• Verify MONAI version and upgrade to 1.6.1 or later if vulnerable
• Restrict access to inference_information.json
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the insecure deserialization vulnerability in MONAI. The vulnerability allows potential code execution on vulnerable MONAI instances if attackers can modify inference_information.json and point it at a malicious pickle. Defenders should verify MONAI versions and configurations, and remediate by upgrading to MONAI 1.6.1 or later. Evidence is limited to public CVE details and source item information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.