Database/AI/ML frameworks & serving
PyTorch (`torch.load`): RCE via unsafe deserialization even with `weights_only=True`
Impact
RCE via unsafe deserialization even with weights_only=True
Who can reach it
Customer-supplied .pt/.pth checkpoint file loaded by any tenant job or by a provider-run model-import service
What to do
No host patch. Bump torch>=2.6.0 in every base image the provider ships; if the tenant pins an old torch in their own image, the provider cannot remediate — advise migration to safetensors. Shared responsibility: provider owns base images, tenant owns pinned envs
Fleet impact
How widespread
Universal - PyTorch ≤2.5.1 is in essentially every AI container image in every GPU fleet
Cost to remediate
**Image rebuild across the fleet** (node-drain for anything long-running) - the fix is torch>=2.6.0 inside every tenant and platform image; you cannot hot-patch a library already imported into a running training job
Why it hits the whole fleet
torch.load(weights_only=True) - the setting everyone was told was the safe one - is bypassable, so *every* checkpoint-loading path in the fleet is an RCE sink; 130+ public PoCs
References
Related entries
- vLLM (`PyNcclPipe` KV transfer): RCE via the KV cache transfer integrationCVE-2025-47277 · vLLM (`PyNcclPipe` KV transfer)Critical
- Keras: Deserialization of untrusted data in 3.11.0–3.11.2CVE-2025-49655 · KerasCritical
- Ollama (API auth): Critical authentication bypass on API endpoints through v0.12.3CVE-2025-63389 · Ollama (API auth)Critical
- Portkey AI Gateway: Gateway resolves the destination baseURL from attacker-controlled precedenceCVE-2025-66405 · Portkey AI GatewayCritical
- MLflow (jobs API): `/ajax-api/3.0/jobs/*` unauthenticated even with basic-auth enabledCVE-2026-0545 · MLflow (jobs API)Critical
- Keras (Lambda layer): Arbitrary code execution via Lambda-layer deserialization in 3.14.0CVE-2026-12481 · Keras (Lambda layer)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.