Hugging Face peft: CorDA and LoRA-GA load cache files with unsafe torch.load, giving code execution

Impact

The CorDA and LoRA-GA initialization paths call torch.load on cache and covariance files named in the adapter config without weights_only=True, skipping the safe-loading wrapper peft uses elsewhere. A pickle in one of those files runs as arbitrary Python inside the training process at the moment the adapter is initialized. On a shared GPU cluster that means code executing as the training job's user, on a node with the accelerators, driver nodes and any mounted shared storage or credentials in reach. The realistic route is a fine-tuning recipe, an adapter bundle, or a shared artifact directory that a job picks up - the attacker does not need to touch the node directly, only to influence a file the job reads.

Who can reach it

Anyone who can place or substitute the config-referenced cache or covariance file that a peft training job loads - a shared artifact store, a downloaded adapter bundle, or a user-supplied recipe. Requires that a job be run against the attacker's file (CVSS UI:R).

What to do

The record names no fixed peft version and links only the upstream repository and source file, so do not schedule against a version number yet. In the meantime, treat CorDA and LoRA-GA cache and covariance files as executable input: restrict write access to the directories jobs load them from, refuse externally sourced adapter bundles for these two initializers, and run fine-tuning pods as unprivileged users without cluster credentials mounted. Check upstream peft releases for the weights_only fix before planning the upgrade.

References

Related entries

• ChromaDB (Rust): Missing authorization validationCVE-2026-8828 · ChromaDB (Rust)High
• vLLM OpenAI-compatible server (qwen3_coder tool-call parser): Code execution inside the serving process, which on a GPUNCVD-2025-017-vllm-openai-compatible-server-qw · vLLM OpenAI-compatible server (qwen3_coder tool-call parser)High
• vLLM (multimodal prompt embeddings, sparse tensor validation): This is the advisory saying the earlier fix did notNCVD-2026-043-vllm-multimodal-prompt-embedding · vLLM (multimodal prompt embeddings, sparse tensor validation)High
• MLflow (statsmodels flavor, MLFLOW_ALLOW_PICKLE_DESERIALIZATION guard): SECURITY CONTROL BYPASS LEADING TO RCE: theNCVD-2026-054-mlflow-statsmodels-flavor-mlflow · MLflow (statsmodels flavor, MLFLOW_ALLOW_PICKLE_DESERIALIZATION guard)High
• Pure Storage FlashArray authentication input validation: Malformed input during authentication takes the FlashArrayCVE-2025-0051 · Pure Storage FlashArray authentication input validationHigh
• Ollama: malformed base64 image data crashes the model runner via null pointer dereferenceCVE-2025-15514 · Ollama (multi-modal image handling in /api/chat)High