CVE-2026-71281: Hugging Face PEFT LoRA-GA RCE Vulnerability

CVE-2026-71281 Overview

CVE-2026-71281 is an insecure deserialization vulnerability in Hugging Face's Parameter-Efficient Fine-Tuning (PEFT) library. The LoRA-GA and CorDA initialization modules call torch.load() on user-supplied cache and covariance files without setting weights_only=True. This bypasses PEFT's own safe-loading wrapper used elsewhere in the codebase. Because torch.load() without weights_only=True performs full Python pickle deserialization, loading a crafted cache or covariance file results in arbitrary code execution. The flaw is classified as [CWE-502] Deserialization of Untrusted Data.

Critical Impact
A malicious LoRA-GA or CorDA cache file, once loaded by an unsuspecting user, executes attacker-controlled Python code with the privileges of the training process.

Affected Products

Hugging Face PEFT library, src/peft/tuners/lora/corda.py (approximately lines 102 and 163)
Hugging Face PEFT library, src/peft/tuners/lora/loraga.py (approximately line 101)
Downstream projects and notebooks that consume shared LoRA-GA or CorDA cache and covariance artifacts

Discovery Timeline

2026-08-05 - CVE-2026-71281 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71281

Vulnerability Analysis

The PEFT library provides adapter-based fine-tuning methods including LoRA-GA (gradient-approximated LoRA) and CorDA (context-oriented decomposition adaptation). Both methods rely on precomputed statistics stored on disk, such as gradient caches for LoRA-GA and covariance matrices for CorDA. These files are frequently shared across teams or downloaded from external repositories to avoid recomputing expensive tensors.

The affected modules load these artifacts by calling torch.load() directly against paths supplied through configuration. Elsewhere in PEFT, a safe-loading wrapper enforces weights_only=True to restrict deserialization to tensor data. The LoRA-GA and CorDA code paths skip this wrapper. As a result, any pickle stream inside the cache or covariance file is deserialized in full, including arbitrary Python object graphs and __reduce__ payloads.

Root Cause

The root cause is the direct use of PyTorch's default pickle-based deserializer without the weights_only=True guard. torch.load() inherits Python pickle semantics, and pickle deserialization can invoke arbitrary callables during object reconstruction. Bypassing PEFT's own safe-loading helper leaves attacker-controlled bytes in complete control of the interpreter.

Attack Vector

An attacker publishes a malicious LoRA-GA gradient cache or CorDA covariance file to a model hub, dataset mirror, or shared storage location. A victim configures LoRA-GA or CorDA initialization to reference this file, then runs training or fine-tuning. When torch.load() deserializes the file, embedded pickle instructions execute attacker code inside the training process. This typically yields access to model weights, API tokens, cloud credentials, and any GPU host resources.

The vulnerability requires user interaction, because the victim must configure PEFT to load the malicious artifact. See the PEFT source on GitHub for the affected call sites.

Detection Methods for CVE-2026-71281

Indicators of Compromise

Unexpected outbound network connections from Python training processes shortly after PeftModel or get_peft_model initialization.
New shell processes, curl, wget, or python -c child processes spawned by a Jupyter kernel or training script.
LoRA-GA or CorDA cache files sourced from third-party URLs, model hubs, or shared object storage without provenance controls.

Detection Strategies

Grep repositories and container images for torch.load( calls that omit weights_only=True, focusing on peft/tuners/lora/corda.py and peft/tuners/lora/loraga.py.
Instrument Python environments to log calls to pickle.Unpickler.find_class during model loading and alert on non-tensor class resolutions.
Inspect .pt, .bin, and .ckpt cache and covariance files with a pickle disassembler such as pickletools and flag GLOBAL, REDUCE, or INST opcodes referencing os, subprocess, builtins, or posix.

Monitoring Recommendations

Monitor endpoint and workload telemetry for Python interpreters spawning shells, network utilities, or credential-access tools during model training.
Audit MLflow, Weights & Biases, and internal artifact stores for LoRA-GA or CorDA files uploaded by non-authoritative accounts.
Alert on egress from GPU training subnets to unexpected destinations, including paste sites and unknown model hubs.

How to Mitigate CVE-2026-71281

Immediate Actions Required

Upgrade Hugging Face PEFT to a version that enforces weights_only=True in the LoRA-GA and CorDA loaders once the maintainers release the fix.
Quarantine any LoRA-GA gradient caches and CorDA covariance files obtained from untrusted or unverified sources.
Restrict fine-tuning workloads to isolated environments without production credentials, cloud roles, or long-lived API tokens.

Patch Information

Refer to the Hugging Face PEFT repository for the corrected loader implementation. The fix routes LoRA-GA and CorDA loading through PEFT's existing safe-loading wrapper, which sets weights_only=True and rejects arbitrary pickle payloads. Rebuild any container images and re-pin PEFT in requirements.txt and pyproject.toml after upgrading.

Workarounds

Locally patch src/peft/tuners/lora/corda.py and src/peft/tuners/lora/loraga.py to pass weights_only=True to torch.load() until an official release is available.
Regenerate LoRA-GA and CorDA statistics in-house rather than consuming shared artifacts from external sources.
Enforce cryptographic signing and checksum verification for all model and adapter artifacts before they are loaded by training pipelines.

bash

# Verify PEFT loader call sites in your environment
python - <<'PY'
import inspect, peft.tuners.lora.corda as c, peft.tuners.lora.loraga as l
for mod in (c, l):
    src = inspect.getsource(mod)
    for i, line in enumerate(src.splitlines(), 1):
        if 'torch.load' in line and 'weights_only' not in line:
            print(f'{mod.__name__}:{i}: {line.strip()}')
PY