CVE-2026-118684
Medium · 5.9CVSS
5.9
EPSS
0.2%
Published
Oct 28, 2026
CISA due date
—
The record
MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-108015 Private keys for eight eMudhra intermediate CA certificates have been compromised… CWE-327
- CVE-2026-108014 Private keys for eight eMudhra intermediate CA certificates have been compromised… CWE-327
- CVE-2026-114820 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-327
- CVE-2026-91403 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-327
- CVE-2026-81822 The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards… CWE-327
- CVE-2026-16693 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain… CWE-327
- CVE-2026-81859 CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive… CWE-327
- CVE-2026-76133 The affected Ebyte product uses a deprecated hashing algorithm in an… CWE-327