CVE-2026-69112 Overview
CVE-2026-69112 is a path traversal vulnerability [CWE-22] in Hugging Face Accelerate versions through 1.14.0. The flaw resides in the load_checkpoint_in_model and load_checkpoint_and_dispatch functions. Both functions fail to sanitize weight_map entries parsed from sharded checkpoint index files. An attacker who controls a checkpoint index can supply relative paths containing ../ sequences or absolute paths to read arbitrary files from the host. The same primitive allows an attacker to point shard entries at named pipes (FIFOs), causing the loader to block indefinitely and produce a denial-of-service condition. Exploitation requires a user to load a malicious checkpoint, aligning with the local attack vector and user-interaction requirement in the CVSS 4.0 metrics.
Critical Impact
Malicious sharded checkpoints can read arbitrary files or hang model loading pipelines, undermining confidentiality and availability of ML training and inference workloads.
Affected Products
- Hugging Face Accelerate versions up to and including 1.14.0
- Python-based machine learning pipelines that call load_checkpoint_in_model
- Python-based machine learning pipelines that call load_checkpoint_and_dispatch
Discovery Timeline
- 2026-08-10 - CVE-2026-69112 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-69112
Vulnerability Analysis
Accelerate supports loading sharded model checkpoints described by an index JSON file. The index contains a weight_map dictionary that maps tensor names to shard filenames. The vulnerable functions concatenate these entries with a base directory without validating that the resulting paths remain inside the checkpoint directory. This exposes two distinct abuse paths from a single input surface.
The first abuse path is arbitrary file read. An attacker crafts a weight_map entry pointing to a location outside the checkpoint directory. The loader opens the referenced file and attempts to parse it as tensor data. Read errors and metadata can leak file contents or existence back to the attacker in error messages and logs.
The second abuse path is denial of service. A weight_map entry can reference a named pipe on the host. The loader opens the FIFO for reading and blocks indefinitely because no writer supplies data. This stalls training jobs, inference workers, and any automation that consumes untrusted checkpoints.
Root Cause
The root cause is missing input sanitization on filesystem path components sourced from an untrusted JSON document. The functions treat weight_map values as safe relative filenames and do not enforce containment within the checkpoint directory. There is no check that the resolved path is a regular file, which permits FIFO abuse.
Attack Vector
Exploitation requires a victim to load an attacker-supplied sharded checkpoint using Accelerate. This scenario is common when consuming community models, third-party fine-tunes, or downloaded artifacts referenced by pipeline configurations. The attacker does not need code execution or credentials on the target host; they only need the victim to invoke the affected loader on a controlled index file.
The vulnerability is described in prose here because no verified public exploit code is available. See the VulnCheck Security Advisory and the upstream GitHub Issue Discussion for technical detail.
Detection Methods for CVE-2026-69112
Indicators of Compromise
- Sharded checkpoint index files whose weight_map values contain ../, ..\, or paths beginning with /, ~, or a drive letter.
- Python processes that stall inside load_checkpoint_in_model or load_checkpoint_and_dispatch with open file descriptors pointing to FIFO nodes.
- Filesystem accesses from ML worker processes to paths outside the intended checkpoint or cache directories (for example, /etc/passwd, ~/.ssh/, or cloud metadata mounts).
Detection Strategies
- Statically scan downloaded *.index.json files for weight_map entries that escape the checkpoint directory or reference absolute paths.
- Instrument the loader with an open() wrapper that logs and blocks paths resolving outside a configured allowlist.
- Alert on ML worker processes that exceed expected checkpoint-load durations, which can indicate a FIFO-based hang.
Monitoring Recommendations
- Collect endpoint telemetry from ML build hosts, training nodes, and inference servers, including process command lines and file-open events.
- Monitor for Python processes reading sensitive files shortly after invoking Accelerate loaders.
- Track outbound network traffic from ML workers to detect secondary exfiltration of data harvested through the read primitive.
How to Mitigate CVE-2026-69112
Immediate Actions Required
- Upgrade Hugging Face Accelerate to a fixed release once available and pin the version in dependency manifests.
- Treat all third-party sharded checkpoints as untrusted input and validate weight_map entries before invoking the loader.
- Run model-loading workloads under a non-privileged service account with a restricted filesystem view (chroot, container, or seccomp profile).
Patch Information
Upstream fixes are tracked in GitHub Pull Request 4070 and GitHub Pull Request 4138. Refer to the VulnCheck Security Advisory for the current fixed version and backport guidance.
Workarounds
- Pre-validate every weight_map value: reject entries containing .., absolute paths, or symbolic links before calling the loader.
- Load checkpoints only from directories mounted read-only and isolated from sensitive files such as SSH keys, cloud credentials, and configuration secrets.
- Enforce file-type checks so that shard targets must be regular files, preventing FIFO-based denial of service.
- Load untrusted models inside ephemeral containers with no access to host secrets or the wider filesystem.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
