• Severity: CVSS 4.0 9.3 Critical (CVSS 3.1 9.8)
  • Affected: Public advisory lists ComfyUI through v0.23.0; upstream code indicates the vulnerable call remained through v0.25.1
  • Patched: ComfyUI v0.26.0, released June 23, 2026 · Exploitation: No public PoC or confirmed successful exploitation; attempts reportedly observed

Introduction

CVE-2026-68771 is a critical unauthenticated remote code execution vulnerability in ComfyUI, the popular node-based interface and backend for generative AI workflows.

Published on July 31, 2026, the vulnerability affects the LoadTrainingDataset node and is classified as CWE-502: Deserialization of Untrusted Data. An attacker who can reach the ComfyUI HTTP API can upload a malicious PyTorch pickle shard and submit a workflow that causes the server to deserialize it.

The result is arbitrary command execution as the user running ComfyUI.

Instances bound only to the default localhost address are not remotely reachable from another machine. Deployments exposed through --listen, Docker port publishing, public notebooks, reverse proxies, or cloud GPU hosts are the real concern.

ComfyUI v0.26.0 and later are not affected by this specific deserialization path.

Attribution note: VulnCheck credits researcher Bofei Chen for CVE-2026-68771. The technical details in this article are based on VulnCheck’s advisory, the upstream ComfyUI patch, and the project’s release history.

What Happened

The vulnerable LoadTrainingDataset node searches a dataset folder for files matching the shard_*.pkl naming pattern. It then opens each shard using the following PyTorch call:

shard_data = torch.load(f)

On older PyTorch versions, torch.load() defaults to unrestricted pickle deserialization. A crafted pickle object can define a malicious __reduce__ method that tells Python to execute a function during loading.

ComfyUI’s unauthenticated API provides the remaining pieces. An attacker can upload the malicious shard through POST /upload/image, then submit a workflow through POST /prompt that invokes LoadTrainingDataset and references the uploaded file.

The upstream fix was one very important argument:

shard_data = torch.load(f, weights_only=True)

This restricts loading to supported tensor-oriented data instead of allowing arbitrary Python objects to wake up and choose violence.

Pickle is a file format right up until somebody deserializes it as executable Python. Then it becomes a remote shell wearing a data-science badge. :/

CVE-2026-68771 Trust Boundary Map

Fig 1: Trust boundaries crossed during exploitation

Attack Sequence

The attacker first needs network access to the ComfyUI HTTP service. No ComfyUI account or existing workflow permissions are required when the vulnerable endpoints are publicly reachable without an authentication layer.

A malicious file named like a training shard is uploaded using the image-upload endpoint. The attacker then submits a workflow graph containing the LoadTrainingDataset node and points it toward the uploaded shard.

When ComfyUI processes the workflow, torch.load() deserializes the pickle data. The attacker’s __reduce__ payload executes inside the ComfyUI Python process, inheriting its filesystem permissions, environment variables, network access, and access to connected storage.

Two HTTP requests later, the AI image server is doing something considerably less artistic.

Why This Is Especially Dangerous

A successful attacker may gain:

  • Remote command execution without authentication
  • Access to model files, workflows, prompts, outputs, and uploaded data
  • Environment variables containing API keys or service credentials
  • Access to shared storage mounted inside containers or GPU instances
  • A foothold for persistence through startup scripts, scheduled tasks, or custom nodes
  • Network access to other internal services reachable from the ComfyUI host
  • Control of expensive GPU resources for cryptomining or other workloads

The highest-risk environments are Internet-facing ComfyUI deployments, shared research servers, hosted GPU machines, and reverse-proxied installations without authentication or strict access controls.

Affected Versions

BranchVulnerable VersionsFix Available
Official CVE rangeComfyUI through v0.23.0Upgrade to v0.26.0 or later
Additional upstream releasesv0.24.0 through v0.25.1 still contain the unsafe callUpgrade to v0.26.0 or later
Patched releasesv0.26.0 and laterAlready patched
Localhost-only installationsVulnerable code may exist, but it is not remotely reachable from another host by defaultUpgrade anyway

The published CVE range currently stops at v0.23.0. However, upstream source for v0.24.0 and v0.25.1 still calls torch.load(f) without weights_only=True, while v0.26.0 is the first tagged release containing the patch.

Until the public range is corrected or clarified, treat all ComfyUI releases before v0.26.0 as affected.

CVE-2026-68771 Version and Disclosure Timeline

Fig 2: Vulnerable releases, patch integration, and CVE publication

Mitigations

1. Upgrade to ComfyUI v0.26.0 or later

Update using ComfyUI Desktop, ComfyUI Manager, or the installation method used for your deployment. Confirm that comfy_extras/nodes_dataset.py contains:

shard_data = torch.load(f, weights_only=True)

2. Stop exposing ComfyUI directly to the Internet

Bind ComfyUI to 127.0.0.1 unless remote access is required. For remote deployments, place it behind a VPN or authenticated reverse proxy and restrict access by network or identity.

Do not publish port 8188 directly to the Internet.

3. Restrict the vulnerable API paths

As a temporary emergency measure, limit access to:

POST /upload/image
POST /prompt

Allow only trusted clients or internal networks. Blocking /prompt will disrupt normal API-based workflow execution, so this should not replace patching.

4. Disable dataset-loading functionality when unused

Remove access to the LoadTrainingDataset node or isolate training workflows until the server can be upgraded.

5. Investigate exposed vulnerable systems

If an affected instance was publicly accessible, review it as a potentially compromised host. Preserve logs, inspect spawned processes and recently created files, and rotate secrets accessible to the ComfyUI process.

Indicators of Compromise

No public file hashes, command-and-control domains, attacker IP addresses, or confirmed payload signatures were available as of August 3, 2026.

Defenders should hunt for behavioural indicators instead.

On the device

  • Unexpected shard_*.pkl files in ComfyUI-managed directories
  • Python or ComfyUI spawning shells, PowerShell, curl, wget, miners, or unfamiliar binaries
  • Recently modified startup scripts, custom nodes, shell profiles, SSH keys, or scheduled tasks
  • New files created shortly after dataset-loading workflows were executed
  • Unexplained GPU, CPU, or outbound network activity

In traffic logs

  • A POST /upload/image request followed shortly by POST /prompt from the same source
  • Multipart uploads containing filenames matching shard_*.pkl
  • Workflow graphs invoking LoadTrainingDataset unexpectedly
  • Requests to port 8188 from unfamiliar external addresses
  • Large or unusual outbound connections originating from the ComfyUI host

Configuration integrity

  • Unexpected use of --listen or binding to 0.0.0.0
  • Public reverse-proxy routes added without authentication
  • Recent firewall or container port-publishing changes
  • Modifications to comfy_extras/nodes_dataset.py
  • Newly installed or modified custom nodes

Continue monitoring the NVD record, ComfyUI repository, and security advisories for updated IoCs or confirmation of successful exploitation.

References