Insufficient Integrity Verification in MONAI Before Version 1.6.1

CVE-2026-118684

What is CVE-2026-118684?

MONAI, prior to version 1.6.1, features an insufficient integrity verification flaw within the check_hash() function. This vulnerability allows the function to incorrectly assess hash values, particularly returning True when the hash_val is None, while defaulting to MD5. This could enable attackers, via man-in-the-middle attacks or registry compromise, to substitute legitimate bundles, datasets, or model archives with malicious versions that lack proper hash checks. Consequently, this raises serious concerns about the integrity and security of files downloaded, as it opens the door to potential file delivery of harmful content and subsequent code execution.

References