Skip to content
Fencer Vulns
high 8.8

CVE-2026-71281 json

peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

published 2026-08-05 3 mo ago modified 2026-10-23 16 d ago also EUVD-2026-53366

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load on config-specified cache/covariance files without weights_only=True, bypassing peft's own safe-loading wrapper used elsewhere in the codebase.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-71281 updated cvss 8.8

peft: peft: Arbitrary Code Execution via Unsafe Deserialization in LoRA-GA and CorDA Modules

  • Red Hat Lightspeed Core lightspeed-core/lightspeed-stack-rhel9
    affected: workaround, no fix available
  • Red Hat AI Inference Server rhaiis/vllm-rocm-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-rocm-rhel9, rhelai3/bootc-azure-rocm-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-openvino-model-server-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhai-early-access/docling-serve-cuda-rhel9, rhoai/odh-th06-cuda130-torch291-py312-rhel9
    affected: workaround, no fix available
  • Red Hat AI Inference Server 3.4 rhaii/vllm-rocm-rhel9 1791856725
    fixed: vendor fix RHSA-2026:83121
  • Red Hat OpenShift AI 2.25 rhoai/odh-caikit-nlp-rhel9 1791448212, rhoai/odh-training-rocm62-torch24-py311-rhel9 1788178712, rhoai/odh-training-rocm62-torch25-py311-rhel9 1788178637, rhoai/odh-training-cuda121-torch24-py311-rhel9 1788178589, rhoai/odh-training-cuda124-torch25-py311-rhel9 1788178620
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.3 rhoai/odh-training-rocm64-torch28-py312-rhel9 1789492674, rhoai/odh-training-rocm64-torch29-py312-rhel9 1789492734, rhoai/odh-training-cuda128-torch28-py312-rhel9 1789492708, rhoai/odh-training-cuda128-torch29-py312-rhel9 1789492653
    fixed: vendor fix RHSA-2026:73987
  • Red Hat OpenShift AI 3.4 rhoai/odh-automl-rhel9 1791535789, rhoai/odh-ta-lmes-job-rhel9 1791470318, rhoai/odh-th06-cpu-torch210-py312-rhel9 1791874335, rhoai/odh-th06-rocm64-torch291-py312-rhel9 1791872119, rhoai/odh-th06-cuda130-torch210-py312-rhel9 1791961113, rhoai/odh-training-rocm62-torch24-py311-rhel9 1791556531, +7 more
    fixed: vendor fix RHSA-2026:84734
  • Red Hat OpenShift AI 3.5 rhoai/odh-th-torch-cpu-py312-rhel9 1791926611, rhoai/odh-th-torch-cuda-py312-rhel9 1791927642, rhoai/odh-th-torch-rocm-py312-rhel9 1791925861
    fixed: vendor fix RHSA-2026:86891
show 1 more
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-caikit-tgis-serving-rhel9, rhoai/odh-kserve-autogluon-server-rhel9, rhoai/odh-kserve-storage-initializer-rhel9 Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1788331391, rhoai/odh-rhel9-operator 1792570619, rhoai/odh-vllm-cpu-rhel9 1786712073, rhoai/odh-vllm-cpu-rhel9 1792018436, rhoai/odh-dashboard-rhel9 1788312226, rhoai/odh-dashboard-rhel9 1791853525, +138 more Red Hat OpenShift AI 3.3 rhoai/odh-cli-rhel9 1790070206, rhoai/rhai-cli-rhel9 1790070206, rhoai/odh-mlflow-rhel9 1789653606, rhoai/odh-trainer-rhel9 1790136369, rhoai/odh-maas-api-rhel9 1790131842, rhoai/odh-mlserver-rhel9 1789121365, +73 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-mlflow-rhel9 1791865967, rhoai/odh-autorag-rhel9 1791557539, rhoai/odh-trainer-rhel9 1791869783, rhoai/odh-eval-hub-rhel9 1791852583, +87 more Red Hat OpenShift AI 3.5 rhoai/odh-cli-rhel9 1791945905, rhoai/rhai-cli-rhel9 1791945905, rhoai/odh-automl-rhel9 1791916705, rhoai/odh-mlflow-rhel9 1791947857, rhoai/odh-autorag-rhel9 1791903266, rhoai/odh-trainer-rhel9 1791952138, +110 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • huggingface peft

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.