CVE-2026-118684

    Dashboard / Vulnerabilities / CVE-2026-118684

    CVE-2026-118684

    Published: 28 Oct 2026Last Modified: 5 Nov 2026

    Summary: MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads

    Details: MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118684.json, https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-hhh4-h52m-fqh6, https://nvd.nist.gov/vuln/detail/CVE-2026-118684, https://www.vulncheck.com/advisories/monai-before-1.6.1-missing-integrity-verification-via-check-hash-in-downloads

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -f2ec87ae9b536baaeca1d6bcc2b6349369e2af8f

    Affected versions

    1.6.0rc1
    1.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118684 | CVE-DB