CVE-2026-118684 Details
Description
MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.
A vulnerability exists in MONAI versions prior to 1.6.1, where the integrity verification function 'check_hash()' fails to properly validate hashes. The function defaults to using MD5, a cryptographically broken algorithm, and incorrectly returns True when the hash value is None. This flaw allows attackers to perform man-in-the-middle attacks or compromise the registry by substituting bundles, datasets, or model archives with malicious versions, potentially leading to unauthorized code execution.
Users can upgrade to MONAI version 1.6.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-hhh4-h52m-fqh6 | CISA-ADP | AdvisoryExploitVendor |
| https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-hhh4-h52m-fqh6 | [email protected] | AdvisoryExploitVendor |
| https://www.vulncheck.com/advisories/monai-before-1.6.1-missing-integrity-verification-via-check-hash-in-downloads | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Project-MONAI MONAI | >= 0, < 1.6.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |