Database/AI/ML frameworks & serving
Hugging Face Accelerate: unsanitized shard paths in a checkpoint index give arbitrary file read and hangs
Impact
Accelerate through 1.14.0 trusts the weight_map entries inside a sharded checkpoint index, so a checkpoint whose index points at ../../etc/... or an absolute path makes the loading process open and read that file instead of a shard. A shard entry pointing at a named pipe blocks the loader indefinitely, stalling the job and holding its GPUs. Any pipeline that loads third-party or user-supplied checkpoints - a model hub mirror, a customer-uploaded fine-tune, a shared scratch filesystem - is the delivery path. The read runs with the privileges of the training or serving process, which on a GPU node often means access to tokens and mounted credentials.
Who can reach it
Anyone who can place or supply a checkpoint directory that the fleet loads; no authentication to the loader itself, but it requires the victim process to load the attacker's checkpoint.
What to do
Upgrade accelerate past 1.14.0 to a release containing the sanitization fix (PRs 4070 and 4138) - no fixed version is stated in the record - rebuild the images that pin it, and restart training and serving jobs. Interim mitigation: only load checkpoints from trusted stores, and validate that every weight_map path is relative and stays inside the checkpoint directory before loading.
References
Related entries
- llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
- llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium
- BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium
- vLLM: DeepStream backend misclassification skips pixel limits and lets unauthenticated video exhaust GPU decodeCVE-2026-78684 · vLLM (DeepStream GPU decode path, pixel-limit enforcement)Medium
- llama.cpp RPC server: crafted tensor dimensions hit a reachable assertion and abort the processCVE-2026-86317 · llama.cpp RPC server (rpc_server::deserialize_tensor in ggml/src/ggml-rpc/ggml-rpc.cpp)Medium
- vLLM: audio extracted from video input ignores decode size and duration limitsCVE-2026-90554 · vLLM (NanoNemotronVL audio-from-video extraction, _extract_audio_from_videos)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.