MONAI: Missing integrity verification in check_hash() for downloads
Summary
MONAI before 1.6.1 skips the hash check of downloaded bundles, datasets and model archives when no hash is passed, and the default hash type is MD5. An attacker who can intercept downloads (man-in-the-middle) or compromise the artifact source can substitute a manipulated file, which may lead to code execution on the host. The risk mainly affects data-science, research and medical-imaging AI systems that download models or datasets without hashes.
Affected
- MONAI versions before 1.6.1 (the CVE record lists 0 to < 1.6.1)
- Lower bound of the affected range: unknown
Fixed in
- Upgrade to MONAI 1.6.1 or later
Workaround
- Until the upgrade, pass an explicit SHA-256 hash with every download call instead of relying on the default.
- Download bundles and model archives only from trusted sources over verified channels, and store and verify their hashes separately.
- No vendor workaround found.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV.
- No public exploit code indexed as of late October 2026.
- EPSS: 0.19 %.
Our recommendation
- Inventory all MONAI installations, including container images and CI runners, and record their versions.
- Upgrade to MONAI 1.6.1 or later and remove older copies from shared environments.
- Until then, require explicit SHA-256 hashes for all downloads and avoid unhashed model or dataset pulls.
- Plan with the CVSS 4.0 score of 8.2 from the CVE record; the vendor advisory lists lower scores, so note this discrepancy.
- Monitor the GitHub advisory GHSA-hhh4-h52m-fqh6 for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-hhh4-h52m-fqh6 github.com
- VulnCheck Advisory: MONAI before 1.6.1 Missing Integrity Verification via check_hash www.vulncheck.com
- MONAI 1.6.1 release notes github.com
- VulDB CVE-2026-118684 vuldb.com
- Threat intelligence record CVE-2026-118684 cve.threatint.com
- Strix CVE-2026-118684 www.strix.ai
- The Hacker Wire CVE-2026-118684 www.thehackerwire.com
- MONAI tutorials PR 2078 (default hash_type change) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:44.
Original description (NVD)
MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.