Which versions of ComfyUI are affected by CVE-2026-68771?

ComfyUI v0.23.0 and all earlier versions are vulnerable to unauthenticated remote code execution (CVSS 9.3), allowing attackers to seize complete control of affected systems without authentication.. A patch is available.

How to fix or mitigate CVE-2026-68771?

Within 24 hours, inventory all ComfyUI deployments running v0.23.0 or earlier and restrict network access to the web interface if immediate patching is not feasible; prioritize isolating internet-facing instances. Within 7 days, apply the vendor-released patch to upgrade all affected ComfyUI instances to the patched version provided by the vendor. Within 30 days, verify complete remediation across all environments (production, staging, development), confirm no instances remain on vulnerable versions, and implement network segmentation restricting ComfyUI web access to authorized users only.

ComfyUI CVE-2026-68771

Q: What is the CVSS score of CVE-2026-68771?

CVE-2026-68771 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-51652 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-31 VulnCheck

GHSA-6p72-9j26-4rmx

Python Deserialization Comfyui Comfy Org

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable endpoints (PR:N, AV:N) with a trivially crafted pickle (AC:L) yield full RCE as the process user, giving C:H/I:H/A:H and S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 31, 2026 - 22:20 vuln.today

Analysis Generated

Jul 31, 2026 - 22:20 vuln.today

CVE Published

Jul 31, 2026 - 21:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt referencing the uploaded file, causing torch.load to deserialize the attacker-controlled pickle payload using __reduce__ and execute arbitrary commands as the ComfyUI process user.

Articles & Coverage 2

News 7 New Python Vulnerabilities - 2 Critical, 5 High, 1 With POC Aug 01, 2026 News Critical RCE in ComfyUI v0.23.0 via Unsafe Pickle Deserialization - CVE-2026-68771 Jul 31, 2026

AnalysisAI

Remote code execution in ComfyUI v0.23.0 (and all prior 0.x releases) lets unauthenticated attackers run arbitrary Python by abandoning the LoadTrainingDataset node to torch.load a malicious pickle. Because the upload and prompt-queue endpoints require no authentication, an attacker who can reach the web interface can upload a crafted shard_*.pkl file and trigger deserialization to execute commands as the ComfyUI process user. VulnCheck reported the flaw and a vendor fix exists; there is no public exploit identified at time of analysis, though the technique (pickle __reduce__ abuse) is trivial to reproduce.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data). ComfyUI's dataset loading node (comfy_extras/nodes_dataset.py) called PyTorch's torch.load() on user-supplied .pkl shard files. torch.load defaults to Python's pickle module, which invokes an object's __reduce__ method during unpickling - allowing an attacker to embed a callable such as os.system that runs at load time. The affected component is the comfy-org:comfyui application (cpe:2.3:a:comfy-org:comfyui:*), a widely used node-graph front-end for Stable Diffusion and other generative-AI models. The vendor fix (PR #14543, commit 94ee49b) hardens the call to torch.load(f, weights_only=True), which restricts unpickling to tensor/weight primitives and blocks arbitrary object reconstruction.

RemediationAI

Apply the vendor fix from PR #14543 / commit 94ee49b1612824366a8631ea069b2a1fa5c73720 (https://github.com/Comfy-Org/ComfyUI/pull/14543), which changes torch.load to use weights_only=True; upgrade to a build that includes this commit past 0.23.0 - an exact tagged patched release version is not independently confirmed from the provided data, so verify the running build contains the commit. As compensating controls where immediate patching is not possible: do not expose the ComfyUI web server (default port 8188) to untrusted networks - bind it to localhost or place it behind an authenticating reverse proxy or VPN, since the /upload/image and /prompt endpoints are unauthenticated by design; block or restrict access to the /upload/image endpoint at the proxy to prevent attacker-controlled .pkl uploads, accepting that this may break legitimate dataset-upload workflows; and avoid running ComfyUI as a privileged user to limit blast radius, noting this does not prevent code execution, only reduces post-exploitation impact.