CVE-2026-118684

MONAI download helpers can accept artifacts without an expected hash

Project MONAI · MONAI check_hash and download_url

First documented disclosure · Review checkpoint

Summary

Missing expected hashes allow substituted model, bundle or dataset downloads to pass integrity checking.

Severity and exploitation evidence

High · 8.2/10 · CVSS 4.0. Severity source.

Exploitation not established: The original report demonstrates hash checks accepting altered local files when no expected value is supplied. Malicious deployment or compromise is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

check_hash returns success when no expected hash is supplied; affected helpers also default to MD5. Several download paths omit the expected hash.

Conditions required

Ability to replace a downloaded artifact, such as compromise of its registry or distribution path, and a workflow that does not supply a trusted expected digest.

Potential impact

Untrusted files enter the AI pipeline. Code execution additionally depends on a downstream unsafe loader or executable bundle; the hash-skipping flaw alone does not demonstrate host compromise.

Affected versions and configurations

Before 1.6.1 according to the VulnCheck CNA. The older GitHub advisory has inconsistent range metadata.

Fix and mitigation status

1.6.1 includes SHA-256 defaults and a warning for omitted hashes. It does not require a digest or fail closed when one is absent.

Practical next steps

Update and require independently trusted SHA-256 digests or signatures for production downloads; reject missing verification in deployment policy. Do not treat the new warning as authentication of the artifact.

Operating lesson

A hash function provides no integrity guarantee without a trusted expected value.

Evidence and limits

Public PR 9088 explicitly addressed this GHSA on September 3; 1.6.1 shipped September 27, the full advisory appeared October 13, and the CNA October 28. The earlier April hash-mismatch PR is a different failure mode. Severity 8.2 is VulnCheck CVSS 4.0; the GitHub report contains different and internally inconsistent ratings. The actual patch warns on missing hashes rather than implementing the report's proposed mandatory-hash behavior.

Sources