CVE-2026-68771: Unauthenticated RCE in ComfyUI via Pickle Deserialization

A critical remote code execution vulnerability in ComfyUI, the node-based interface that has become the default way tens of thousands of practitioners run Stable Diffusion and other diffusion models, allows an unauthenticated attacker to run arbitrary code on the host simply by uploading a crafted file and submitting a workflow. CVE-2026-68771 carries a CVSS 3.1 score of 9.8 and stems from an all-too-familiar root cause in the machine learning ecosystem: loading untrusted data with Python’s pickle format through PyTorch’s torch.load() without the safety flag that prevents arbitrary code execution. The flaw was published July 31, 2026, and a fix landed in the project’s repository weeks earlier through a hardening commit that closed the last unguarded torch.load() call in the codebase.

ComfyUI sits at an unusual point in the AI supply chain compared to the inference servers and agent frameworks that dominate most vulnerability disclosures this year. It is not a backend service tucked behind a load balancer. It is a desktop and self-hosted tool that generative AI hobbyists, artists, and small studios run directly on their own machines, often with a web UI exposed to a local network or, in a meaningful number of cases, to the open internet through a reverse proxy or a cloud GPU rental with a public IP. That deployment pattern turns what looks like a niche node bug into a broad, opportunistic attack surface.

How the LoadTrainingDataset Node Fails

ComfyUI’s LoadTrainingDataset node exists to let users load pre-processed training data, packaged as shard files, back into a workflow for fine-tuning or LoRA training tasks. The node’s execute method reads the shard file and hands it to PyTorch’s torch.load() function to deserialize.

The problem is that torch.load() is not, by default on older PyTorch releases, a safe deserializer. It relies on Python’s pickle module under the hood, and pickle was never designed to parse untrusted input. A pickle stream can embed a __reduce__ call that tells the unpickler to execute an arbitrary callable with attacker-chosen arguments as part of reconstructing the object graph. That is the mechanism, not an obscure edge case: it is documented pickle behavior that every security-conscious ML engineer is supposed to route around, typically by setting weights_only=True, which restricts deserialization to tensor-compatible data and refuses to instantiate arbitrary Python objects.

Every other torch.load() call in the ComfyUI codebase, in comfy/utils.py and comfy/sd1_clip.py, already carried that safety flag. The LoadTrainingDataset node was the one holdout, according to the fix commit that closed the gap on June 18, 2026.

The Exploit Path

The attack chain requires no authentication at any stage:

1. The attacker crafts a malicious pickle file, disguised as a training dataset shard (shard_*.pkl), embedding a __reduce__ payload that executes an OS command when unpickled.
2. The attacker uploads the file through ComfyUI’s /upload/image endpoint, which does not require credentials on a default install and does not validate that uploaded content matches its declared type.
3. The attacker submits a workflow graph through the /prompt API endpoint that references the uploaded shard in a LoadTrainingDataset node.
4. When ComfyUI executes the queued workflow, it calls torch.load() on the attacker’s file. Pickle deserialization triggers the embedded __reduce__ call, and arbitrary code runs with whatever privileges the ComfyUI process holds.

There is no social engineering step, no need to trick a user into opening a file, and no authentication barrier to bypass. Anyone who can reach the HTTP API can walk through all four steps programmatically.

Why the Blast Radius Matters Here

Code execution in the ComfyUI process is not a contained event. ComfyUI installs commonly run with access to:

• Local model weight caches and custom nodes, some of which are pulled from community repositories with far looser vetting than mainstream package registries, giving an attacker a foothold from which to poison further downstream artifacts.
• GPU resources, making compromised instances a target for cryptomining or unauthorized inference workloads, a pattern already documented against other exposed AI infrastructure this year.
• Local filesystem access, including any credentials, API keys, or cloud provider tokens sitting in environment variables or config files on the host, since ComfyUI is frequently run directly on a developer workstation or a cloud GPU instance rather than in a hardened container.
• Whatever network segment the host sits on. Cloud GPU rentals used for image generation are often provisioned quickly, with security as an afterthought, and may have broader internal network reach than the operator realizes.

ComfyUI’s own growth is part of what makes this significant. It has become the preferred interface for a majority of Stable Diffusion users and is embedded inside a wide range of downstream products and hosted generation services that wrap it as a backend. A vulnerability in the core project propagates into every service built on top of it that has not independently patched or sandboxed the deserialization path.

Pattern Recognition: This Is Not a New Kind of Bug

Unsafe pickle and torch.load() deserialization has been one of the most consistently exploited weaknesses across the ML tooling ecosystem for the past two years, showing up in model-serving frameworks, inference SDKs, and now a desktop-oriented generation tool. The recurrence is not because the fix is hard. Setting weights_only=True is a one-line change, as the ComfyUI patch demonstrates. It recurs because pickle-based serialization is the path of least resistance for anyone loading PyTorch tensors, and it is easy for a single unguarded call to slip through a codebase that otherwise does the right thing everywhere else, exactly as happened here.

Defensive Guidance

Patch immediately. Update ComfyUI to a version that includes the weights_only=True fix in comfy_extras/nodes_dataset.py, merged in commit 94ee49b and tracked upstream in pull request #14543. Confirm the fix is present rather than assuming an update pulled it in, since ComfyUI’s rapid release cadence means version numbers alone are not a reliable indicator.

Never expose ComfyUI’s API directly to the internet without an authentication layer in front of it. The /upload/image and /prompt endpoints have no built-in access control on a default installation. Put ComfyUI behind a reverse proxy that enforces authentication, or restrict access to a VPN or trusted network segment, regardless of whether you have patched.

Audit custom nodes and dataset-loading extensions for the same anti-pattern. ComfyUI’s extensibility is its strength and its risk: any third-party node that calls torch.load(), pickle.load(), or numpy.load() with allow_pickle=True on user-supplied or externally sourced files carries the identical risk class, and the community node ecosystem has far less scrutiny than the core project.

Run generation workloads in isolated, disposable environments where feasible. Container or VM isolation limits what an attacker gains even if a deserialization exploit succeeds, and disposable GPU instances reduce the value of any persistence an attacker might attempt to establish.

Treat any file format that wraps pickle as untrusted input by default. This includes .pt, .pth, .ckpt, and similar checkpoint formats in addition to explicit shard files. Where possible, prefer formats like safetensors that are designed to be safe against exactly this class of attack, and flag any workflow that still depends on legacy pickle-based checkpoints for review.