CVE-2026-109360: MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP
MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True, executing code when SEResNet50 or other SENet models are constructed with pretrained=True.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
MONAI versions from 0.4.0 before 1.6.1 are exposed when they construct SEResNet50 or other SENet models with pretrained=True and fetch pretrained weights over plaintext HTTP.
What does an attacker need to exploit it?
The attacker must be able to tamper with the plaintext HTTP download path, such as an on-path position. No prior privileges are required, but exploitation requires a user or process to trigger construction of an affected model with pretrained=True.
How can I determine whether my application may have been affected?
Check whether it uses an affected MONAI version and creates SENet models with pretrained=True. Also review whether pretrained weight downloads occurred over HTTP, since a substituted .pth file can execute code when it is unpickled.