EUVD-2026-29561
GHSA-xp5q-5q7g-q26r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) in its model serving component. When starting a model server with the ludwig serve command, the framework loads model weight files using torch.load() without enabling the security-restrictive weights_only=True parameter. This default behavior allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by providing a maliciously crafted PyTorch model file, leading to arbitrary code execution on the system hosting the Ludwig model server.
AnalysisAI
Remote code execution in Ludwig framework ≤0.10.4 allows unauthenticated network attackers to execute arbitrary code by supplying a malicious PyTorch model file to the ludwig serve endpoint. The vulnerability stems from unsafe deserialization in the model loading component, which uses torch.load() without the weights_only=True safety parameter. With CVSS 9.8 (critical network vector, no authentication required) but only 0.02% EPSS, this represents a high-severity issue in vulnerable deployments, though widespread exploitation has not been observed. No CISA KEV listing or public POC identified at time of analysis.
Technical ContextAI
Ludwig is an open-source deep learning framework built on PyTorch for training and serving machine learning models. The vulnerability exists in the model serving component invoked via the ludwig serve command. When loading PyTorch model weight files, Ludwig calls torch.load() with default parameters, which permits deserialization of arbitrary Python objects through the pickle protocol. Pickle deserialization (CWE-502) is inherently unsafe when processing untrusted data because pickle can instantiate arbitrary Python classes and execute code during unpickling. PyTorch introduced the weights_only=True parameter as a security control to restrict deserialization to tensor objects only, preventing object instantiation attacks. Ludwig versions through 0.10.4 fail to enable this protection, creating a classic insecure deserialization vulnerability in any deployment that accepts model files from untrusted sources or allows user-controlled model uploads to the serving endpoint.
RemediationAI
Upgrade to Ludwig version 0.10.5 or later when available, as the vendor advisory at https://www.notion.so/CVE-2026-31238-35d1e1393188819ea77ee98ca85a2878 should contain patch details. Until patching is feasible, implement these specific compensating controls: (1) Restrict model file sources to trusted internal repositories only - disable any user upload functionality to ludwig serve endpoints and validate model provenance cryptographically if possible; (2) Run ludwig serve processes in sandboxed containers with minimal privileges, no network egress except required destinations, and read-only filesystem mounts to limit blast radius of successful exploitation; (3) Implement network-level access controls to ensure only authenticated, authorized clients can reach ludwig serve endpoints - never expose port directly to internet; (4) Monitor ludwig serve processes for unexpected child processes, network connections, or filesystem modifications indicating exploitation attempts. Note that sandboxing significantly impacts performance and may break legitimate model loading workflows. If modifying Ludwig source directly is acceptable, manually patch torch.load() calls to include weights_only=True, though this may cause compatibility issues with models containing custom objects. Consult official Ludwig repository (https://github.com/ludwig-ai/ludwig) for vendor-validated patches and migration guidance.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today