High-Severity MONAI Flaw Lets Local Users Run Code via Poisoned Pickle Cache

A newly published vulnerability, CVE-2026-100841, affects MONAI, the open-source PyTorch framework for medical imaging AI. Every release of the monai pip package through version 1.6.0 is affected.

The flaw is in how PersistentDataset reads its pickle cache.

In MONAI 1.6.0, PersistentDataset in monai/data/dataset.py rejects the combination of track_meta=True and weights_only=True. Users who cache MetaTensors, the default tensor type since MONAI 1.0, are therefore forced to load cached files with torch.load and weights_only=False, which unpickles whatever sits in the cache directory. The advisory also flags cache helpers in monai/data/utils.py that call pickle.loads on cached content and derive cache keys with MD5.

An attacker needs local write access to a shared cache.

A local user who can write to a shared or world-writable cache_dir, such as /tmp/monai_cache, HPC scratch space or ~/.cache/monai, can plant a malicious file there, creating a poisoned pickle cache. The next time another user's MONAI pipeline reads the cache, the file is deserialized, letting the attacker run code in that user's context. The attack vector is local, and MONAI's advisory describes it as a privilege-escalation risk on shared HPC clusters.

It is rated high severity.

VulnCheck, which assigned the CVE, scores it 8.5 under CVSS 4.0 and 7.8 under CVSS 3.1, both high. The scores reflect low attack complexity, low privileges required, no user interaction and high impact to confidentiality, integrity and availability. MONAI's own GitHub advisory, GHSA-636w-j999-g7x5, published on August 21, also rates it high at 7.8.

No stable fix has shipped.

The advisory lists no patched version, and the NVD entry, published on September 26, says all released versions are affected. The 1.6.1 release candidate tagged on September 18 changes this code: PersistentDataset no longer blocks MetaTensor caching with weights_only=True, and cache keys use SHA-256 instead of MD5. It is not yet a stable release. Until one lands, teams should avoid shared or world-writable cache directories; the advisory's recommended fix includes creating cache folders with owner-only 0700 permissions.