CVE-2026-68771: ComfyUI Unsafe Deserialization RCE Flaw

CVE-2026-68771 Overview

CVE-2026-68771 is an unsafe deserialization vulnerability in ComfyUI v0.23.0 that enables unauthenticated remote code execution. The flaw resides in the LoadTrainingDataset node, which invokes torch.load on attacker-controlled shard_*.pkl files without safe-loading protections. Attackers upload a crafted pickle file through the unauthenticated POST /upload/image endpoint, then queue a workflow via POST /prompt referencing the uploaded shard. Deserialization triggers Python's __reduce__ mechanism, executing arbitrary commands as the ComfyUI process user. The vulnerability is classified under [CWE-502] Deserialization of Untrusted Data.

Critical Impact
Unauthenticated attackers can achieve remote code execution on ComfyUI v0.23.0 instances reachable over the network, gaining full command execution as the ComfyUI process user.

Affected Products

ComfyUI v0.23.0
ComfyUI LoadTrainingDataset node in comfy_extras/nodes_dataset.py
Any ComfyUI deployment exposing the HTTP API without an authentication proxy

Discovery Timeline

2026-07-31 - CVE-2026-68771 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-68771

Vulnerability Analysis

ComfyUI's LoadTrainingDataset node loads training dataset shards from disk using PyTorch's torch.load function. The default behavior of torch.load uses Python's pickle module, which permits arbitrary object reconstruction through the __reduce__ protocol. When a pickle stream is deserialized, any callable specified in __reduce__ executes with attacker-controlled arguments.

Exploitation chains two unauthenticated HTTP endpoints. The attacker first sends a POST /upload/image request carrying a malicious shard_*.pkl payload. The server writes the file into the dataset directory without validating file type or content. The attacker then issues a POST /prompt request that queues a workflow graph referencing the uploaded shard. When the node executes, torch.load(f) deserializes the payload, invoking the embedded callable and running attacker commands under the ComfyUI process account.

Root Cause

The root cause is calling torch.load without the weights_only=True flag on files sourced from untrusted input. PyTorch's default loader treats pickle streams as trusted, allowing arbitrary code execution during deserialization. Compounding the issue, both the upload endpoint and the workflow submission endpoint lack authentication, giving any network-adjacent attacker a direct path to trigger the vulnerable code.

Attack Vector

The attack is remote and unauthenticated. An attacker who can reach the ComfyUI HTTP listener uploads a crafted pickle file, then submits a workflow that forces LoadTrainingDataset to open it. No user interaction, credentials, or prior access are required.

python

# Security patch applied in comfy_extras/nodes_dataset.py (PR #14543)
            shard_path = os.path.join(dataset_dir, shard_file)

            with open(shard_path, "rb") as f:
-                shard_data = torch.load(f)
+                shard_data = torch.load(f, weights_only=True)

            all_latents.extend(shard_data["latents"])
            all_conditioning.extend(shard_data["conditioning"])

Source: ComfyUI commit 94ee49b. The patch adds weights_only=True, restricting torch.load to tensor data and rejecting arbitrary pickle opcodes.

Detection Methods for CVE-2026-68771

Indicators of Compromise

Unexpected shard_*.pkl files written into ComfyUI dataset directories, especially with recent timestamps and small sizes atypical of real training shards.
HTTP access logs showing POST /upload/image followed by POST /prompt from the same client with no prior authenticated session context.
ComfyUI process spawning child processes such as /bin/sh, bash, python, curl, or wget that are unrelated to workflow execution.
Outbound network connections from the ComfyUI host to unknown IP addresses shortly after workflow submission.

Detection Strategies

Alert on ComfyUI process ancestry that includes shell interpreters or command-line download utilities, indicating post-deserialization command execution.
Inspect uploaded files in the dataset directory for pickle magic bytes (\\x80\\x04) combined with __reduce__ or posix.system references.
Correlate /upload/image and /prompt requests from unauthenticated sources against workflow graphs that reference LoadTrainingDataset.

Monitoring Recommendations

Enable process-level telemetry on hosts running ComfyUI and forward events to a centralized analytics platform for behavioral analysis.
Monitor egress traffic from GPU workstations and inference servers where ComfyUI is deployed, since these hosts rarely initiate outbound sessions.
Track file writes to ComfyUI dataset directories and flag .pkl files created outside of expected training workflows.

How to Mitigate CVE-2026-68771

Immediate Actions Required

Upgrade ComfyUI to the version containing commit 94ee49b1612824366a8631ea069b2a1fa5c73720, which enforces weights_only=True on training shard loads.
Remove direct network exposure of the ComfyUI HTTP interface and place it behind an authenticating reverse proxy or VPN.
Audit the dataset directory for unrecognized shard_*.pkl files and review recent /upload/image and /prompt request logs for signs of exploitation.

Patch Information

The fix is delivered in ComfyUI Pull Request #14543 and merged as commit 94ee49b. Additional context is available in the VulnCheck advisory. Users should update from the ComfyUI repository and restart the service.

Workarounds

Restrict inbound access to the ComfyUI HTTP port using host firewalls or network ACLs, limiting connections to trusted operators only.
Run ComfyUI under a dedicated, low-privileged service account with no write access outside required working directories to contain any post-exploitation activity.
Disable or remove the LoadTrainingDataset node from workflows until the patched version is deployed.
Deploy an authenticating reverse proxy in front of ComfyUI to block anonymous POST /upload/image and POST /prompt requests.

bash

# Verify the ComfyUI installation contains the weights_only=True fix
grep -n "torch.load" comfy_extras/nodes_dataset.py

# Expected output on patched systems:
# shard_data = torch.load(f, weights_only=True)

# Restrict network exposure until patched (example using iptables)
iptables -A INPUT -p tcp --dport 8188 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8188 -j DROP