{"id":"CVE-2026-118684","kind":"vulnerability","aliases":["CVE-2026-118684"],"related":[],"title":"MONAI: hash check silently passes when no hash given, enabling file substitution","description":"MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.","summary":"MONAI versions before 1.6.1 have a check_hash() function that returns True without verifying anything when no expected hash is supplied. An attacker who can intercept downloads or compromise a registry can swap in malicious bundles, datasets, or model archives that are then accepted, which can lead to code execution.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["medical-imaging","ml-models","monai","package","python"],"not_affected_if":["hashes-always-supplied","local-files-only","version-1.6.1-or-later"],"how_to_check":"- Run `pip show monai` and confirm the installed version is below `1.6.1`\n- Search project code and downloader calls for `check_hash(` or download helpers invoked without a `hash_val` argument","fix":"- Upgrade MONAI to `1.6.1` or later\n- Until upgraded, pass an explicit expected hash to every download and verification call so the check cannot be skipped","status":"open","published_at":"2026-10-28T19:17:35+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","triaged_at":"2026-10-28T19:35:55+00:00","updated_at":"2026-10-28T19:35:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T19:35:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MONAI to `1.6.1` or later\n- Until upgraded, pass an explicit expected hash to every download and verification call so the check cannot be skipped","reach":"network","title":"MONAI: hash check silently passes when no hash given, enabling file substitution","impact":"high","summary":"MONAI versions before 1.6.1 have a check_hash() function that returns True without verifying anything when no expected hash is supplied. An attacker who can intercept downloads or compromise a registry can swap in malicious bundles, datasets, or model archives that are then accepted, which can lead to code execution.","category":"package","nicknames":[],"who_cares":["python","monai","medical-imaging","ml-models"],"confidence":0.6,"needs_auth":"no","worst_case":"malicious bundle or model runs code on the host","analyst_note":"Confirm from the NVD entry or the MONAI release notes which download paths call check_hash without a hash, and whether 1.6.1 is the confirmed fixed version.","how_to_check":"- Run `pip show monai` and confirm the installed version is below `1.6.1`\n- Search project code and downloader calls for `check_hash(` or download helpers invoked without a `hash_val` argument","needs_analyst":true,"not_affected_if":["version-1.6.1-or-later","hashes-always-supplied","local-files-only"],"who_is_affected":"Teams using MONAI to download bundles, datasets, or model archives without supplying hashes are exposed, because the integrity check does nothing in that case. Systems that only load local, already-trusted files or always pass a verified hash are less exposed. Users on 1.6.1 or later are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000639,"input_tokens":3341,"output_tokens":609,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118684':15A,18A '-2026':14A,17A '1.6.1':31B,80C 'accept':71B 'anyth':42B 'archiv':67B,122C 'attack':50B,106C 'bundl':63B,118C 'check':3A,34B,88C 'code':76B,132C 'compromis':56B,115C 'contain':81C 'cve':13A,16A 'dataset':64B,119C 'default':103C 'deliveri':129C 'download':54B,123C 'enabl':10A,126C 'execut':77B,133C 'expect':45B 'file':11A,128C 'function':36B 'given':9A 'hash':2A,8A,35B,46B,89C,95C,104C,125C 'imag':21B 'insuffici':83C 'integr':84C 'intercept':53B 'lead':74B 'malici':62B,127C 'man':109C 'man-in-the-middl':108C 'md5':100C 'medic':20B 'medical-imag':19B 'middl':112C 'ml':23B 'ml-model':22B 'model':24B,66B,121C 'monai':1A,25B,28B,78C 'none':98C 'packag':26B 'pass':5A 'perform':107C 'potenti':131C 'python':27B 'registri':58B,114C 'return':38B,92C 'silent':4A,91C 'substitut':12A,117C 'suppli':48B 'swap':60B 'true':39B,93C 'type':105C 'val':96C 'verif':85C 'verifi':41B 'version':29B 'vulner':86C 'without':40B,124C","nicknames":[],"mitigations":[],"who_affected":"Teams using MONAI to download bundles, datasets, or model archives without supplying hashes are exposed, because the integrity check does nothing in that case. Systems that only load local, already-trusted files or always pass a verified hash are less exposed. Users on 1.6.1 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118684","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118684","severity":null,"published_at":"2026-10-28T19:17:35+00:00","modified_at":"2026-10-28T19:17:35+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","fetched_at":"2026-10-28T19:34:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}