CVE-2026-118684: MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-28 · updated 2026-10-28
Weakness: CWE-327

Description

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives downloaded without hashes, enabling malicious file delivery and potential code execution.

Affected products

Project-MONAI MONAI: before 1.6.1 — fixed in 1.6.1

How to fix

Upgrade to a fixed version: Project-MONAI MONAI 1.6.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-118684 or the next vulnerability affects your stack