CVE-2026-62997: Kedro-Datasets PyTorch RCE Vulnerability

CVE-2026-62997 Overview

CVE-2026-62997 is an insecure deserialization flaw in the kedro_datasets_experimental.pytorch.PyTorchDataset component of Kedro-Datasets. Versions 5.0.0 through 9.4.x load .pt model files using torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch releases earlier than 2.6, loading a malicious pickle-backed model executes arbitrary Python code inside the Kedro pipeline process. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data and is fixed in kedro-datasets version 9.5.0.

Critical Impact
Attacker-controlled .pt files loaded through the experimental PyTorch dataset achieve arbitrary code execution in the context of the Kedro pipeline runner.

Affected Products

kedro-datasets versions 5.0.0 through 9.4.x (experimental component only)
kedro_datasets_experimental.pytorch.PyTorchDataset
Deployments running PyTorch earlier than 2.6 with untrusted .pt inputs

Discovery Timeline

2026-09-16 - CVE-2026-62997 published to NVD
2026-09-17 - Last updated in NVD database
Fix released - kedro-datasets version 9.5.0 published on GitHub (release notes)

Technical Details for CVE-2026-62997

Vulnerability Analysis

The experimental PyTorchDataset class wraps torch.load to hydrate model state from .pt files on disk or in partitioned data sources. Prior to the fix, the loader called torch.load directly without passing weights_only=True, and any load_args supplied through the Kedro data catalog were discarded before reaching PyTorch. As a result, no user-visible configuration could restrict deserialization to safe tensor types.

Because .pt files produced by torch.save are zip containers around a pickle stream, torch.load invokes the Python pickle module to reconstruct arbitrary objects. On PyTorch versions earlier than 2.6, the default behavior permits pickle opcodes such as REDUCE, which dispatch to attacker-chosen callables. A crafted checkpoint can therefore trigger arbitrary imports and function calls during load.

The scope is limited to pipelines that opt into kedro_datasets_experimental and consume model files from untrusted or shared sources such as public model registries, mirrored checkpoints, or partitioned external buckets. Pipelines that load only vetted artifacts from trusted storage are not exposed.

Root Cause

The dataset implementation did not thread load_args through to torch.load and did not set a secure default. This combination silently disabled the primary mitigation PyTorch provides for untrusted files and prevented operators from opting in via configuration.

Attack Vector

An attacker who can influence the bytes of a .pt file consumed by a Kedro pipeline embeds a malicious pickle payload in the checkpoint. When the pipeline executes the affected dataset, torch.load deserializes the payload and executes attacker-controlled code with the privileges of the pipeline process. Delivery paths include compromised model registries, poisoned artifact caches, and shared partitioned datasets.

python

 class PyTorchDataset(AbstractVersionedDataset[Any, Any]):
-    """`PyTorchDataset` loads and saves PyTorch models' `state_dict` using PyTorch's recommended zipfile serialization protocol to avoid security issues with Pickle.
+    """`PyTorchDataset` loads and saves PyTorch models' `state_dict` using ``torch.save``
+    and ``torch.load``.
+
+    .. warning::
+        Loading is **not** safe for untrusted files. ``torch.load`` deserializes a
+        pickle stream (the zipfile produced by ``torch.save`` is only a container
+        around that pickle), so a maliciously crafted ``.pt`` file can execute
+        arbitrary code on load. To mitigate this, ``PyTorchDataset`` enforces
+        ``weights_only=True`` by default, which restricts loading to tensors and a
+        small allow-list of safe types. Only set ``load_args: {weights_only: false}``
+        for files you fully trust, and prefer ``torch>=2.6`` (where ``weights_only=True``
+        is also the upstream default) or a non-pickle format such as ``safetensors``
+        when handling untrusted inputs.

Source: kedro-plugins commit 4d6deb7. The patch defaults weights_only=True and forwards load_args to torch.load.

Detection Methods for CVE-2026-62997

Indicators of Compromise

Unexpected child processes spawned by the Python interpreter running a Kedro pipeline, particularly shells, package managers, or network utilities.
Outbound network connections from data engineering worker nodes to unfamiliar hosts immediately after a pipeline load step.
.pt files in artifact stores whose SHA-256 hashes do not match the values recorded by the training pipeline.

Detection Strategies

Inventory Kedro projects and dependency manifests for kedro-datasets versions below 9.5.0 that also import from kedro_datasets_experimental.pytorch.
Instrument pipeline runners with process-tree telemetry so that python processes performing torch.load are correlated with any subsequent process creation or socket activity.
Add static analysis rules that flag torch.load calls without weights_only=True in internal Python code and Jupyter notebooks.

Monitoring Recommendations

Log the source URI, version tag, and hash of every model artifact consumed by production pipelines, and alert on unsigned or unknown sources.
Monitor CI/CD and orchestration platforms (Airflow, Argo, Kubeflow) for pipeline runs that pull .pt files from external registries.
Review kedro-datasets upgrade activity across repositories to confirm remediated versions are deployed.

How to Mitigate CVE-2026-62997

Immediate Actions Required

Upgrade kedro-datasets to version 9.5.0 or later in every environment that uses the experimental PyTorch dataset.
Upgrade PyTorch to 2.6 or later so that weights_only=True is the upstream default even for direct torch.load calls.
Audit existing .pt artifacts consumed by Kedro pipelines and re-derive them from trusted training runs when provenance cannot be verified.

Patch Information

The fix is delivered in kedro-datasets 9.5.0 via pull request #1433 and commit 4d6deb7. Additional context is available in GitHub Issue #1431 and GHSA-f9q4-h45w-jrrq.

Workarounds

Migrate untrusted model exchange to a non-pickle format such as safetensors and avoid torch.load for those artifacts.
Restrict pipeline inputs to a signed, internally controlled model registry and reject artifacts lacking a verified checksum.
If upgrading is not immediately possible, replace kedro_datasets_experimental.pytorch.PyTorchDataset with a custom dataset that calls torch.load(..., weights_only=True) explicitly.

bash

# Upgrade to the patched release
pip install --upgrade 'kedro-datasets>=9.5.0'

# Ensure a safe PyTorch runtime
pip install --upgrade 'torch>=2.6'

# Verify installed versions
python -c "import kedro_datasets, torch; print(kedro_datasets.__version__, torch.__version__)"