CVE-2026-44484
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in PyTorch Lightning versions 2.6.2 and 2.6.2 introduces functionality consistent with credential harvesting.
Risk Assessment
An attacker can exploit this vulnerability to capture sensitive credentials, leading to unauthorized access to systems and data.
Recommendation
Immediately update PyTorch Lightning to the latest available version that fixes this vulnerability and review configurations for any suspicious changes.
Other vulnerabilities in PyTorch Lightning
See all- CVE-2026-31221High
PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method calls torch.load() without setting the security-restrictive weights_only=True parameter, allowing deserialization of arbitrary Python objects.
- CVE-2026-58659High
A vulnerability in PyTorch Lightning up to version 2.6.5 (fixed in commit d710d68) allows remote code execution via the _load_state function, which imports and executes attacker-controlled module names from _instantiator hyperparameters in checkpoint files. Attackers can craft malicious checkpoint files that bypass weights_only=True protections and execute arbitrary code when LightningModule.load_from_checkpoint is called.
Original NVD description (English source)
PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS