Which versions of Amazon GluonTS are affected by CVE-2026-100308?

GluonTS versions before 0.17.0 contain a high-severity model-loading flaw that can allow arbitrary OS command execution when a user loads a crafted serialized model directory.. A patch is available.

How to fix or mitigate CVE-2026-100308?

Vendor-released patch: 0.17.0. Within 24 hours, inventory all GluonTS deployments and identify any version before 0.17.0; apply the vendor patch by upgrading affected systems to GluonTS 0.17.0, and if immediate upgrade is not possible, disable loading of models from untrusted hubs, shared directories, or external pipelines and restrict model loading to self-generated trusted artifacts. Within 7 days, complete patching across production, development, and CI/CD environments; enforce model provenance and integrity checks so only approved models can be loaded; and scan shared model repositories and pipeline artifacts for unauthorized or crafted serialized model directories. Within 30 days, verify no persistence or unauthorized access in affected environments, implement least-privilege execution for model-loading processes, add monitoring for anomalous model-loading activity, and update secure model supply-chain governance to require validation of external model artifacts before use.

Amazon GluonTS CVE-2026-100308

Q: What is the CVSS score of CVE-2026-100308?

CVE-2026-100308 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-88979 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-09-29 AMZN

Python Deserialization AWS Gluonts

8.4

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local model-load path (AV:L) requiring the victim to open a crafted model (UI:R), no prior privileges (PR:N); unsafe deserialization yields code execution with full C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 30, 2026 - 11:24 vuln.today

Metadata Corrected

Sep 29, 2026 - 16:40 vuln.today

tag: Python added

Analysis Updated

Sep 29, 2026 - 16:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 29, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Sep 29, 2026 - 16:22 NVD

7.8 (HIGH) 8.4 (HIGH)

Analysis Generated

Sep 29, 2026 - 15:50 vuln.today

CVE Published

Sep 29, 2026 - 15:05 cve.org

HIGH 7.8

DescriptionCVE.org

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory.

To remediate this issue, users should upgrade to version 0.17.0 or later.

AnalysisAI

Deserialization of untrusted data in the GluonTS model-loading component allows arbitrary OS command execution with the privileges of the loading process when a victim loads a crafted serialized model directory in versions before 0.17.0. The flaw is scored 8.4 under CVSS 4.0 (assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication is required but exploitation is local and depends on a user actively loading the malicious model artifact; the attacker must first place that artifact in the victim's load path (untrusted model hub, shared directory, or compromised pipeline), and environments that only load self-generated trusted models are not affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to load an attacker-controlled serialized GluonTS model directory using the model-loading component of GluonTS before 0.17.0, which internally uses unsafe deserialization (torch.load/pickle). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine deserialization-to-RCE flaw (CWE-502) in the model-loading path of GluonTS, corroborated by the vendor's own fix PR #3304 '[Security] Resolve security issue for torch.load,' confirming an unsafe torch.load/pickle-style deserialization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to Amazon GluonTS 0.17.0 or later, available from the release page at https://github.com/awslabs/gluonts/releases/tag/v0.17.0; this is the definitive fix and is the only remediation that removes the unsafe deserialization path flagged by upstream PR #3304. … Detailed patch versions, workarounds, and compensating controls in full report.