CVE-2026-26215: manga-image-translator RCE Vulnerability

CVE-2026-26215 Overview

CVE-2026-26215 is a critical insecure deserialization vulnerability affecting manga-image-translator version beta-0.3 and prior when running in shared API mode. The vulnerability allows unauthenticated remote code execution through unsafe use of Python's pickle.loads() function on attacker-controlled input without proper validation.

The FastAPI endpoints /simple_execute/{method} and /execute/{method} directly deserialize request bodies using pickle.loads(), enabling attackers to craft malicious pickle payloads that execute arbitrary code in the server context. While a nonce-based authorization mechanism was intended to restrict access, the nonce defaults to an empty string and the authorization check is bypassed, leaving the application completely exposed to remote exploitation.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary code execution on servers running manga-image-translator in shared API mode by sending crafted pickle payloads to exposed API endpoints.

Affected Products

• manga-image-translator version beta-0.3 and earlier
• manga-image-translator installations running in shared API mode
• Systems exposing the FastAPI endpoints /simple_execute/{method} or /execute/{method}

Discovery Timeline

• 2026-02-11 - CVE-2026-26215 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-26215

Vulnerability Analysis

This vulnerability falls under CWE-502 (Deserialization of Untrusted Data), a well-known class of security flaws that can lead to remote code execution. The manga-image-translator application implements a shared API mode that allows distributed processing of manga translation requests. Within this mode, the application exposes FastAPI endpoints that accept serialized Python objects from clients.

The fundamental issue lies in the use of Python's pickle module for deserializing incoming request data. The pickle module is inherently unsafe for untrusted data because it can execute arbitrary Python code during the deserialization process. An attacker can construct a malicious pickle payload containing Python bytecode that executes upon deserialization, achieving code execution with the privileges of the server process.

The vulnerability is further compounded by a broken authorization mechanism. The intended nonce-based access control defaults to an empty string, and the validation logic fails to enforce authentication, effectively making these dangerous endpoints publicly accessible to any network attacker.

Root Cause

The root cause is twofold: First, the application uses pickle.loads() to deserialize untrusted user input at the vulnerable endpoints in manga_translator/mode/share.py (specifically at line 112 and line 130). Second, the nonce-based authorization intended to protect these endpoints defaults to an empty string and fails to properly validate requests, allowing any remote attacker to reach the vulnerable deserialization code without authentication.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to either the /simple_execute/{method} or /execute/{method} endpoint with a malicious pickle payload in the request body.

The exploitation process involves:

1. Identifying a manga-image-translator instance running in shared API mode
2. Crafting a malicious pickle payload that contains Python code to be executed (e.g., reverse shell, file system access, data exfiltration)
3. Sending the payload to one of the vulnerable endpoints
4. The server deserializes the payload using pickle.loads(), triggering arbitrary code execution

For detailed technical analysis and proof-of-concept information, see the Chocapikk RCE Analysis and the VulnCheck Advisory.

Detection Methods for CVE-2026-26215

Indicators of Compromise

• Unexpected HTTP POST requests to /simple_execute/{method} or /execute/{method} endpoints from external IP addresses
• Anomalous process spawning from the Python process running manga-image-translator
• Network connections originating from the application server to unknown external hosts (potential reverse shells)
• Suspicious file system modifications in the server context where manga-image-translator is running

Detection Strategies

• Monitor HTTP access logs for requests targeting /simple_execute/ and /execute/ endpoints, particularly from untrusted sources
• Implement network segmentation and firewall rules to restrict access to shared API mode endpoints
• Deploy endpoint detection and response (EDR) solutions to identify anomalous process behavior stemming from the Python application
• Use application-level logging to track deserialization operations and flag unexpected payload patterns

Monitoring Recommendations

• Enable verbose logging on the FastAPI application to capture all incoming requests to vulnerable endpoints
• Set up alerts for any POST requests to the affected endpoints from non-allowlisted IP addresses
• Monitor system processes for unexpected child processes spawned by the manga-image-translator application
• Implement network monitoring for outbound connections from the server that may indicate successful exploitation

How to Mitigate CVE-2026-26215

Immediate Actions Required

• Disable shared API mode if not strictly required for your deployment
• Implement network-level access controls (firewall rules, security groups) to restrict access to the API endpoints to trusted IP addresses only
• If shared API mode is essential, configure a strong, non-default nonce value to enable the authorization mechanism
• Audit existing deployments for signs of compromise before remediation

Patch Information

At the time of publication, users should monitor the manga-image-translator GitHub repository for security updates. Related issues tracking this vulnerability include GitHub Issue #1116 and GitHub Issue #946. Users are advised to upgrade to the latest version once a patch addressing this deserialization vulnerability is released.

Workarounds

• Do not expose manga-image-translator shared API mode to untrusted networks or the public internet
• Deploy the application behind a reverse proxy with authentication enforcement
• If shared mode is required, implement IP allowlisting at the network or application level to restrict endpoint access
• Consider running the application in an isolated container environment to limit the impact of potential exploitation

# Example: Restrict access to shared API endpoints using iptables
# Only allow connections from trusted internal network (10.0.0.0/8)
iptables -A INPUT -p tcp --dport 5003 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 5003 -j DROP