CVE-2026-118684GHSA-hhh4-h52m-fqh6
MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads
Project-MONAI MONAI
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.6.1MONAICVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.
Text from CVE List
Affected versions 2
- MONAIaffected: all versions before 1.6.1CVE List
- MONAIunaffected: 1.6.1CVE List