CVE-2026-69112

This vulnerability in Accelerate's checkpoint loading exposes a gap that runs deeper than a single input validation bug. The core issue: checkpoint loading functions were designed with an implicit trust model that matched early ML workflows (loading your own weights on your own hardware) but broke down as distributed training became standard and checkpoints flowed between machines. The path traversal vulnerability allows reading arbitrary files through malicious weight_map entries in checkpoint index files. The weight_map abstraction—convenient for sharded checkpoints—treats relative paths as a feature rather than a potential attack surface. When checkpoint loading assumes weight_map is a trusted internal structure rather than an untrusted input, the stage is set for exploitation. The named pipe denial-of-service vector is particularly concerning for operational security. Rather than failing obviously, checkpoint loading hangs silently when encountering a named pipe—an effect that creates cascading failures in long-running distributed training jobs across dozens of GPUs. This silent hang also leaks information about the victim's environment through timing: whether paths exist, whether files are readable. The CVSS 7.1 score misrepresents the real risk. The blast radius extends far beyond the loader itself—Accelerate sits at the center of training pipelines, fine-tuning jobs, and MLOps platforms. A path traversal here is a pivot point: read /etc/passwd today, ~/.aws/credentials tomorrow. Immediate action: patch Accelerate to sanitize all weight_map paths before file resolution. Add timeout logic to file operations to prevent indefinite hangs. Audit any other checkpoint loading entry points for similar patterns. Treat the weight_map input as untrusted by default, not as an internal implementation detail. The deeper pattern: ML tooling inherited trust assumptions from serialization libraries and config parsers—all carrying the same 'data I control' assumption that was never audited at the integration layer. The fix isn't just this patch; it's internalizing that ML tooling now operates in adversarial environments it was never designed for.

Reviewed through automated stages and approved by a human before publication.