Advisory · CVE-2026-100841
MONAI cache poisoning turns a shared scratch dir into RCE
A local user with write access to a shared MONAI cache directory can plant a malicious pickle that executes code in another user's pipeline.
- Vendor
- Project-MONAI
- Product
- MONAI
- Identifier / CWE
- CVE-2026-100841
CWE-502 - Action timing
- Immediate
Explain it like I’m five
MONAI leaves its notebook on a shared desk and copies down whatever anyone wrote there. A neighbor can write 'run this command' in the notebook, and your MONAI obeys it.
- 01Forced unsafe defaults
In MONAI 1.6.0, PersistentDataset rejects track_meta=True with weights_only=True, forcing torch.load with weights_only=False.
- 02Pickle cache helpers
Cache helpers call pickle.loads on cached content and derive cache keys with md5.
- 03Shared cache directory
A local user with write access to a shared or world-writable cache_dir places a malicious pickle file.
- 04Another user's pipeline reads it
The next time another user's MONAI pipeline reads the cache, the pickle deserializes and runs arbitrary code in that user's context.
What happened
MONAI 1.6.0 (CVE-2026-100841, CVSS 8.5) has a deserialization flaw in its caching layer. PersistentDataset explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI 1.0 and later) to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/utils.py also call pickle.loads on cached content and derive cache keys with hashlib.md5.
As a result, a local user with write access to a shared or world-writable cache_dir (for example /tmp/monai_cache, HPC scratch space, or ~/.cache/monai) can place a malicious pickle file that is deserialized the next time another user’s MONAI pipeline reads the cache, resulting in arbitrary code execution in that user’s context. Deployments that do not use shared cache directories are not affected.
No patched version was available as of the advisory. All released versions of the monai pip package are affected.
What to do
- Do not use shared or world-writable cache directories; point
cache_dirat a directory owned by the user running the pipeline. - On shared systems, audit cache directories for unexpected or recently modified files.
- Restrict write access to cache paths used by training and inference jobs.
- Treat any host where a foreign pickle may have been deserialized as potentially compromised.
- Watch the project advisory for a fixed release and upgrade when it lands.
Management note
This is a classic multi-tenant research-cluster risk: one user’s write access becomes another user’s RCE. Fix the directory ownership model now; the patch will only fix the code.