ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node

CVE-2026-68771 is an unsafe pickle deserialization flaw in ComfyUI v0.23.0's LoadTrainingDataset node. The LoadTrainingDataset.execute method calls torch.load() without weights_only=True on user-supplied .pkl shard files. An attacker uploads a crafted shard_*.pkl via the unauthenticated POST /upload/image endpoint, then queues a workflow via POST /prompt referencing that file. Python's pickle.__reduce__ fires during deserialization, granting arbitrary code execution as the ComfyUI process user. Affected: ComfyUI v0.23.0 and likely earlier versions using the same code path. Fixed in commit 94ee49b (PR #14543, merged 2026-06-18) by adding weights_only=True.

The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) is technically accurate for the protocol but overstates real-world risk because ComfyUI binds to 127.0.0.1 by default. An attacker cannot reach it without the operator explicitly passing --listen 0.0.0.0 or proxying it. Censys data shows roughly 1,000–2,800 internet-facing instances globally — a small fraction of total installs. That said, those exposed instances have zero authentication and are actively being targeted by cryptomining botnets (GHOST campaign, NadMesh). For the population that *is* exposed, this is a trivial, weaponizable, no-auth RCE. The vendor’s CRITICAL label is fair for that slice; for the majority on localhost, it’s noise. We split the difference at HIGH.

Why this verdict

• Default bind address caps reachability. ComfyUI listens on 127.0.0.1:8188 out of the box. The CVSS AV:N score assumes network reachability that does not exist in default deployments. This is the largest single friction factor and justifies moving from CRITICAL to HIGH.
• No authentication when exposed. For the subset of instances where an operator has passed --listen 0.0.0.0, there is zero authentication on both /upload/image and /prompt. The chain is fully unauthenticated and requires no user interaction. This prevents a further downgrade to MEDIUM.
• Active campaign interest in ComfyUI. The GHOST and NadMesh campaigns demonstrate that threat actors are actively scanning for and exploiting exposed ComfyUI instances. While they use custom-node code execution rather than this specific CVE, the identical attack surface means this CVE is immediately adoptable into existing tooling.
• Role multiplier: ComfyUI is an AI image-generation workstation tool. (a) *Low-value role*: hobbyist GPU desktop — majority of installs, blast radius is one workstation. (b) *Typical role*: team ML workstation in an enterprise — may hold cloud credentials, model IP, training data. Compromise = host-level, potentially pivoting to cloud accounts. (c) *High-value role*: ComfyUI embedded in CI/CD or model-training pipelines — rare but possible; blast radius could reach supply-chain for AI model artifacts. ComfyUI is NOT a canonical high-value-role component (it is not an IdP, hypervisor, DC, or network edge device). <1% of installs occupy a high-value role. No floor elevation beyond HIGH is warranted.

Why not higher?

CRITICAL would require either KEV listing, canonical high-value-role deployment (ComfyUI is a workstation tool, not infrastructure), or default network exposure. None apply. The default localhost bind means >95% of installations are simply unreachable for this attack vector, and the ~1,000 exposed instances represent a narrow global population.

Why not lower?

MEDIUM would understate the risk for the exposed population. The chain is fully unauthenticated, zero-click, trivially weaponizable with off-the-shelf pickle payloads, and threat actors are *already scanning for ComfyUI instances*. Active campaign interest plus no-auth RCE on exposed hosts demands HIGH at minimum.

1. Bind ComfyUI to localhost only — Ensure ComfyUI is started without --listen or explicitly with --listen 127.0.0.1. This is the default and eliminates remote attack surface entirely. Verify within noisgate mitigation SLA (30 days for HIGH). Audit all ComfyUI launch scripts, systemd units, and Docker compose files for --listen 0.0.0.0.
2. Place a reverse proxy with authentication in front of any intentionally exposed instance — If remote access is required, use nginx/Caddy with OAuth2 Proxy, SSO, or HTTP basic auth. This converts the unauthenticated attack surface into an authenticated one. Deploy within 30 days.
3. Block .pkl file uploads at WAF or reverse proxy — Add a WAF rule to reject POST /upload/image requests where the filename ends in .pkl, .pickle, or .pt. This breaks the upload step of the chain without affecting normal image uploads.
4. Update to post-fix commit — Pull ComfyUI master at or after commit 94ee49b (2026-06-18). The fix is a one-line change adding weights_only=True to torch.load() in comfy_extras/nodes_dataset.py. Apply within the noisgate remediation SLA of 180 days for HIGH.
5. Network-segment GPU workstations — Place ComfyUI hosts in a dedicated VLAN with egress filtering. Restrict outbound to package repos and model registries only. This limits post-exploitation lateral movement and C2 callback.

Run this on each host where ComfyUI is installed. It checks the nodes_dataset.py source for the patched weights_only=True parameter and verifies the listen address. Requires read access to the ComfyUI installation directory. Example: bash check_cve_2026_68771.sh /opt/ComfyUI

#!/usr/bin/env bash\n# CVE-2026-68771 checker for ComfyUI unsafe deserialization\n# Usage: bash check_cve_2026_68771.sh /path/to/ComfyUI\n# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN\n\nset -euo pipefail\n\nCOMFY_DIR=\"${1:-}\"\nif [ -z \"$COMFY_DIR\" ]; then\n  echo \"Usage: $0 /path/to/ComfyUI\"\n  exit 2\nfi\n\nTARGET_FILE=\"${COMFY_DIR}/comfy_extras/nodes_dataset.py\"\n\nif [ ! -f \"$TARGET_FILE\" ]; then\n  echo \"UNKNOWN - File not found: $TARGET_FILE\"\n  echo \"ComfyUI may not have the LoadTrainingDataset node installed.\"\n  exit 2\nfi\n\n# Check if torch.load calls include weights_only=True\nif grep -q 'torch\\.load' \"$TARGET_FILE\"; then\n  # Count torch.load calls without weights_only=True\n  UNSAFE_CALLS=$(grep 'torch\\.load' \"$TARGET_FILE\" | grep -cv 'weights_only' || true)\n  if [ \"$UNSAFE_CALLS\" -gt 0 ]; then\n    echo \"VULNERABLE - CVE-2026-68771\"\n    echo \"Found $UNSAFE_CALLS torch.load() call(s) without weights_only=True in $TARGET_FILE\"\n    grep -n 'torch\\.load' \"$TARGET_FILE\" | grep -v 'weights_only'\n    \n    # Also check listen address in running process\n    if pgrep -f 'comfyui\\|main.py.*--listen' > /dev/null 2>&1; then\n      LISTEN_ADDR=$(ps aux | grep -E 'comfyui|main.py' | grep -oP '\\-\\-listen\\s+\\K[\\d.]+' || echo 'localhost (default)')\n      echo \"Listen address: $LISTEN_ADDR\"\n      if [ \"$LISTEN_ADDR\" = \"0.0.0.0\" ]; then\n        echo \"WARNING: Instance is bound to all interfaces - REMOTELY EXPLOITABLE\"\n      fi\n    fi\n    exit 1\n  else\n    echo \"PATCHED - CVE-2026-68771\"\n    echo \"All torch.load() calls in $TARGET_FILE include weights_only parameter.\"\n    exit 0\n  fi\nelse\n  echo \"UNKNOWN - No torch.load calls found in $TARGET_FILE\"\n  exit 2\nfi

Sources

1. Censys — ComfyUI Cryptomining Botnet Campaign
2. CVE-2026-68771 — THREATINT Detail
3. GitHub PR #14543 — Fix: weights_only=True
4. ComfyUI SECURITY.md — Trust Model
5. The Hacker News — 1,000+ Exposed ComfyUI Instances Targeted
6. GHOST Campaign Targeting Japan ComfyUI Deployments
7. ComfyUI Server Configuration Docs