CVE-2026-100846 is a High (CVSS 7.6) deserialization flaw in MONAI before 1.5.2. The algo_from_pickle function loads a pickle file without validating it, so a crafted file can run code in your application. Upgrade to 1.5.2 or later and avoid untrusted pickles.
What's affected
The weakness is CWE-502 (deserialization of untrusted data). The record says MONAI before 1.5.2 is affected, and the GitHub advisory says versions up to and including 1.5.1 are affected with 1.5.2 as the patched version. Both sources agree on the High rating and 7.6 score.
The function algo_from_pickle in the auto3dseg utilities reads a pickle file and passes its contents to pickle.loads with no check on where the data came from or what it contains. Python pickle can rebuild arbitrary objects, including ones that run code during loading. If an application calls the function on a file an attacker supplied, the attacker's code runs with the application's rights.
The risk depends on how you use the function. A pipeline that only loads pickles that it wrote itself is much less exposed than a service that accepts uploaded files.
How to check if you're exposed
Check the version.
pip show monai
Below 1.5.2 means update. Then search your code for the function and for other pickle loads.
grep -rn "algo_from_pickle\|pickle.load" your_project/
For each hit, ask where the file comes from. Files in a protected directory written by your own jobs are one thing. Files from a shared bucket, an upload form or a downloaded model package are another.
This is also a good place to use reachability analysis. An installed package with a vulnerable function matters far more if your code calls that function than if it never does, and Safeguard reachability analysis is designed to separate those cases.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Upgrade MONAI to 1.5.2 or later.
- Find every call to algo_from_pickle in your code and trace where its input file comes from.
- Do not load pickle files from untrusted sources. Prefer data formats that cannot carry code.
- Restrict write access to directories that hold files your jobs will later unpickle.
- Run model training and inference under limited accounts so that a bad load does not reach secrets.
Why it matters
Pickle is a serialization format that doubles as a code execution format. Python documentation warns against loading pickle data from untrusted sources, and this flaw is a direct instance of that warning. The library function did not add any gate of its own.
Machine learning projects pass pickle files around constantly, between steps of a pipeline and between teams. That habit is the real exposure. The record does not mark the CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is 1.5.2 definitely the fixed version?
Yes by the sources we reviewed. The record says before 1.5.2 and the GitHub advisory lists 1.5.2 as patched.
Does upgrading remove the need to be careful with pickle?
No. Pickle remains unsafe for untrusted data in general. Keep untrusted files out of any pickle load.
Sources
Last reviewed: 18 October 2026.
