PyTorch Lightning: checkpoint loading unpickles arbitrary objects, giving code execution on the GPU node

Impact

load_from_checkpoint() calls torch.load() without weights_only=True, so loading a checkpoint executes whatever the pickle stream says. Anyone who can place a checkpoint file where a training or serving job will read it - a shared model registry, an object store bucket, a tenant-writable scratch path, a downloaded third-party checkpoint - gets code execution as the job's user on the GPU node, with the job's access to data, credentials and the interconnect. On fleets where resume-from-checkpoint is automated, the payload runs without a human ever inspecting the file. Affects 2.6.0 and earlier; the record names no fixed version.

Who can reach it

Anyone who can supply or replace a checkpoint file that a Lightning job loads - no authentication to the cluster itself is needed if the checkpoint path is shared or fetched from a public source. Execution happens with the privileges of the training/serving process.

What to do

The record does not name a fixed release, so treat this as mitigate-only for now: pass weights_only=True (or torch.load with it) wherever you control the call, load checkpoints only from paths your pipeline owns, and make the model registry write-restricted with checksums verified before load. Applying it means changing job code and redeploying training/serving jobs, not draining nodes.

References

Related entries

• llama.cpp (`ggml_nbytes`): Integer overflow in the core ggml size calculationCVE-2026-33298 · llama.cpp (`ggml_nbytes`)High
• BentoML (`docker.system_packages`): Command injection through the package list fieldCVE-2026-33744 · BentoML (`docker.system_packages`)High
• BentoML (cloud deployment path, setup.sh generation in deployment.py): The March fix that added shlex.quote to theCVE-2026-35043 · BentoML (cloud deployment path, setup.sh generation in deployment.py)High
• SGLang (`replay_request_dump.py`): Insecure `pickle.load()` on a `.pkl` dumpCVE-2026-3989 · SGLang (`replay_request_dump.py`)High
• llama.cpp (`llama_batch_init`): Integer overflow from unchecked multiplicationCVE-2026-43627 · llama.cpp (`llama_batch_init`)High
• HuggingFace transformers: Critical RCE in all versions before 5.3.0CVE-2026-4372 · HuggingFace transformersHigh