Skip to content
Heist/ feed
Back to feed
High

MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads

Type: advisorySources: Official CVE List

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.

Products
MONAI
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-118684
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 02:41 UTC · Revision 1

Source evidence

MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads

core-cve · Original source

Published 28 Oct 2026, 18:59 UTC

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.

cve:CVE-2026-118684

MONAI

Fixed versions: Not specified

Complete source record
{
  "id": "7f5ad5df2366c15a6ed0066be6632f2a4eba15e4f8c1ae503a352d31dbe7a87f",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-118684",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads",
    "summary": "MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.",
    "evidence": "cve:CVE-2026-118684",
    "products": [
      {
        "name": {
          "value": "MONAI",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-118684",
      "aliases": [
        "CVE-2026-118684"
      ],
      "metrics": [
        {
          "format": "CVSS",
          "cvssV4_0": {
            "version": "4.0",
            "baseScore": 8.2,
            "attackVector": "NETWORK",
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "userInteraction": "NONE",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "privilegesRequired": "NONE",
            "subIntegrityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "subAvailabilityImpact": "NONE",
            "vulnAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE"
          }
        },
        {
          "format": "CVSS",
          "cvssV3_1": {
            "scope": "UNCHANGED",
            "version": "3.1",
            "baseScore": 5.9,
            "attackVector": "NETWORK",
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "integrityImpact": "HIGH",
            "userInteraction": "NONE",
            "attackComplexity": "HIGH",
            "availabilityImpact": "NONE",
            "privilegesRequired": "NONE",
            "confidentialityImpact": "NONE"
          }
        }
      ],
      "affected": [
        {
          "vendor": "Project-MONAI",
          "product": "MONAI",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.6.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.6.1",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:pypi/monai",
          "defaultStatus": "unaffected"
        }
      ],
      "modified": "2026-10-28T18:59:54.186Z",
      "provider": "cve",
      "references": [
        "https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-hhh4-h52m-fqh6",
        "https://www.vulncheck.com/advisories/monai-before-1.6.1-missing-integrity-verification-via-check-hash-in-downloads"
      ],
      "provider_metadata": {
        "cna": {
          "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
          "shortName": "VulnCheck",
          "dateUpdated": "2026-10-28T18:59:54.186Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-118684",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/containers/cna/metrics"
  },
  "source_id": "core-cve",
  "document_id": 477119,
  "published_at": "2026-10-28T18:59:54.186+00:00"
}