CVE-2026-68771

CVE-2026-68771 gives you unauthenticated remote code execution in ComfyUI through a design pattern the platform actively encourages. The attack works because LoadTrainingDataset nodes must load training data files—and in the PyTorch ecosystem, torch.load() is the frictionless default, even though it permits arbitrary code execution via pickle's __reduce__ protocol by default. The platform provides an unauthenticated /upload/image endpoint that accepts files without validation, which means an attacker can deposit a malicious .pkl file and let the workflow engine pull it into a deserialization context. The fix is straightforward—add weights_only=True to any torch.load() call—but the deeper problem is architectural. This vulnerability's actual severity comes from the blast radius, not the CVSS score. ComfyUI typically runs on GPU compute nodes with access to model weights, cloud credentials, and data stores. More critically, the node-based architecture means a compromise doesn't stay contained: the malicious pickle executes in a shared context that propagates to every downstream node and every other user's queued workflow on a multi-user instance. One payload compromises the entire execution environment. Your immediate actions: audit any custom or third-party nodes that call torch.load() without weights_only=True and patch them. Restrict or disable the /upload/image endpoint if your deployment doesn't require unauthenticated uploads. If you run a shared ComfyUI instance, treat this as a multi-tenant isolation failure and consider network segmentation or workload isolation. The node abstraction assumes workflow composition is legitimate—this vulnerability shows what happens when that assumption meets an unauthenticated input path.

Reviewed through automated stages and approved by a human before publication.