CVE-2026-10043: MosaicML Composer RCE Vulnerability

CVE-2026-10043 Overview

CVE-2026-10043 is an insecure deserialization vulnerability in MosaicML Composer that enables remote attackers to execute arbitrary code on affected installations. The flaw resides in the checkpoint parsing logic, where the library fails to properly validate user-supplied data before deserializing it. Exploitation requires user interaction: a target must load a malicious checkpoint file or visit a malicious page that triggers the parsing routine. Successful exploitation results in code execution in the context of the current process. The vulnerability is tracked under Zero Day Initiative advisory ZDI-26-384 (ZDI-CAN-27990) and is classified as [CWE-502] Deserialization of Untrusted Data.

Critical Impact
An attacker who delivers a malicious Composer checkpoint can achieve arbitrary code execution in the Python process loading the file, with full confidentiality, integrity, and availability impact.

Affected Products

MosaicML Composer (checkpoint loading components in composer/checkpoint/load.py and composer/utils/checkpoint.py)
Machine learning pipelines that ingest third-party or untrusted Composer checkpoints
Training and inference workflows that deserialize pickle-based model state

Discovery Timeline

2026-06-24 - CVE-2026-10043 published to NVD
2026-06-25 - Last updated in NVD database
Reported through the Zero Day Initiative as ZDI-CAN-27990 and disclosed as advisory ZDI-26-384

Technical Details for CVE-2026-10043

Vulnerability Analysis

MosaicML Composer is an open-source PyTorch library used to train deep learning models. Composer serializes training state, optimizer state, model weights, and metadata into checkpoint files that can be reloaded to resume training or run inference. The vulnerable code path parses these checkpoints without enforcing safe deserialization controls, allowing embedded Python objects to execute arbitrary callables during the unpickling process.

The weakness aligns with [CWE-502] Deserialization of Untrusted Data. An attacker crafts a checkpoint file containing a malicious __reduce__ method or equivalent pickle gadget. When a victim loads the file through Composer's checkpoint API, the attacker-supplied callable runs with the privileges of the Python process. Because Composer is widely embedded in ML training pipelines, the executing process often has access to GPUs, cloud credentials, dataset stores, and model registries.

Root Cause

The root cause is the use of unrestricted pickle deserialization within composer/checkpoint/load.py and composer/utils/checkpoint.py. The library trusts that checkpoint files originate from a benign source and does not constrain which classes or callables can be reconstructed during loading. Any attacker capable of substituting or supplying a checkpoint can therefore inject executable Python objects.

Attack Vector

Exploitation requires local access to load the malicious file, combined with user interaction. Typical delivery vectors include hosting a poisoned checkpoint on a public model hub, sharing a checkpoint via collaboration channels, or compromising a shared storage bucket used by an ML team. Once the victim invokes the Composer checkpoint loader against the file, the attacker's payload runs immediately.

python

# Security patch in composer/checkpoint/load.py
# Harden Composer checkpoint deserialization (#3937)
 """API for loading checkpoints."""
 
 import contextlib
+import io
 import logging
 import os
 import pickle

# Security patch in composer/utils/checkpoint.py
 from __future__ import annotations
 
 import contextlib
+import datetime
 import fnmatch
 import logging
 import os
# Source: https://github.com/mosaicml/composer/commit/6405188805a0054b4551ec49e4919c54c971d0e8

The patch in commit 6405188 introduces hardened checkpoint loading paths by routing pickle reads through controlled buffers and additional validation, reducing the attack surface exposed to untrusted checkpoint data.

Detection Methods for CVE-2026-10043

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running Composer training or inference jobs
Outbound network connections initiated by ML worker processes shortly after a load_checkpoint call
Composer checkpoint files originating from unverified sources, public hubs, or unsigned commits
Unexplained modifications to credentials, SSH keys, or cron entries on ML training hosts

Detection Strategies

Hunt for pickle.load or torch.load invocations against files in user-writable or shared paths within Composer workflows
Alert on Python processes that execute shells, package managers, or curl/wget immediately after checkpoint load operations
Inspect checkpoint archives for suspicious classes or __reduce__ references using static pickle disassembly tools such as pickletools
Correlate file write events on checkpoint directories with subsequent process executions inside container or training-job telemetry

Monitoring Recommendations

Forward process, file, and network telemetry from ML training nodes into a central data lake for behavioral analysis
Baseline normal child-process trees for Composer jobs and flag deviations such as interactive shells or compilers
Monitor egress from GPU nodes for connections to non-allowlisted destinations, including paste sites and anonymous infrastructure
Track provenance of checkpoint files by hashing artifacts on ingest and comparing against an internal allowlist

How to Mitigate CVE-2026-10043

Immediate Actions Required

Upgrade MosaicML Composer to a release that includes the hardened checkpoint loader from commit 6405188805a0054b4551ec49e4919c54c971d0e8
Inventory all checkpoint files in shared storage and remove or quarantine artifacts from untrusted sources
Restrict write access to checkpoint directories to a small set of authenticated, audited identities
Treat any checkpoint received from outside the organization as untrusted until validated by a security review

Patch Information

The upstream fix is provided in the MosaicML Composer commit 6405188, titled "Harden Composer checkpoint deserialization (#3937)." Full advisory details are available in Zero Day Initiative Advisory ZDI-26-384. Apply the upstream release and rebuild any container images that bundle Composer.

Workarounds

Load checkpoints only from internal, signed sources and verify integrity with cryptographic hashes before deserialization
Run Composer training and inference jobs in least-privilege containers without access to long-lived cloud credentials
Prefer safer serialization formats such as safetensors for distributing model weights when feasible
Disable automatic checkpoint downloads from public hubs in shared training environments until patched

bash

# Pin Composer to a patched release in your environment
pip install --upgrade 'mosaicml-composer'

# Verify checkpoint integrity before loading
sha256sum /path/to/checkpoint.pt

# Inspect a checkpoint for suspicious pickle opcodes prior to use
python -m pickletools /path/to/checkpoint.pt | grep -E 'GLOBAL|REDUCE|INST|OBJ'