Security · 28 Sep 2026 · Rob Nidschelm

Why a MONAI Model Bundle Deserves a Software Review

Files, configuration and caches can become Python code. The six project advisories have different prerequisites and fixes.

Repository disclosures began in April, followed by June and August 2026; NVD indexed the records afterwards. This was missed material, not a fresh disclosure, breach or evidence of current exploitation.

A bundle is more than model weights

CVE-2026-100840 affects MONAI through 1.6.0. The bundle engine resolves _target_ to any importable callable and evaluates $ expressions. Loading or running hostile bundles executes with user privileges. No patch is listed.

Cache access crosses user boundaries

CVE-2026-100841 affects all releases at disclosure, with no patch listed. Local write access to shared or world-writable caches lets an attacker plant a pickle another pipeline deserialises. In shared high-performance computing, cache ownership, permissions and keys affect security and performance.

Four further paths and distinct version claims

• CVE-2026-100843 concerns unsafe pickle.loads() in algo_from_pickle() before 1.6.0.
• CVE-2026-100846 covers the same function: repository and NVD say before 1.5.2; GitHub’s reviewed entry names 1.6.0. The later advisory reports an incomplete earlier fix. Preserve both identifiers and source versions; intervening releases remain unverified.
• CVE-2026-100844 concerns crafted nnUNet configuration or arguments reaching subprocess with shell=True, allowing arbitrary commands to run. NVD gives a range before 1.6.0; the repository lists 1.5.1.
• CVE-2026-100845 concerns NumPy loading with allow_pickle=True: crafted .npy or .npz files contain executable objects. NVD’s boundary is before 1.6.0, the fix named by both; the repository lists through 1.5.2.

These are separate trust decisions involving bundles, caches, explicit imports, training commands and image loaders. Neither one function nor one workflow covers everything.

Six checks for medical-AI teams

• Upgrade fixed workflows. Choose a release with documented 1.6.0 pickle, command and NumPy fixes; verify the branch. That does not establish fixes for the two advisories without listed patches.
• Review bundle configuration, helpers and weights as software. Vet sources; pin versions; verify signatures or hashes.
• Separate caches by user. Restrict permissions and rebuild from trusted inputs, without shared writable directories across trust boundaries.
• Choose safer loaders and formats. Avoid pickle and dynamic evaluation.
• Isolate third-party training and inference. Minimise privileges, exclude production credentials and restrict network egress.
• Review provenance across weights, packages, configuration, preprocessing code and data.

Our earlier AI-boundary reporting describes execution through apparently ordinary inputs. Here, collaboration-friendly formats put the security decision in the loader; healthcare teams should scrutinise model artefacts as they do conventional software.

The sources checked for this 27 October review establish neither clinical compromise nor patient-data access nor live exploitation. Demonstrations and dated proof-of-concept labels are not evidence of an attack.

Sources and chronology

• Bundle advisory: 21 August 2026, 14:15:00 UTC / 16:15:00 CEST.
• Shared-cache advisory: 21 August 2026, 14:13:43 UTC / 16:13:43 CEST.
• Later deserialisation, command and array-loader advisories: 11 June 2026, between 12:40 and 12:42 UTC / 14:40 and 14:42 CEST.
• Earlier advisory: 3 April 2026, 22:50:09 UTC / 00:50:09 CEST on 4 April.
• Reviewed catalogue entry, rechecked 27 October 2026: its fixed-version claim differs as described above; its catalogue date is distinct from repository disclosure.
• NVD indexed all six on 27 September 2026, between 02:17:22 and 02:17:23 UTC / 04:17:22 and 04:17:23 CEST. Those records supplied the original indexing signal.