CVE-2026-68771: ComfyUI Unsafe Deserialization Bug - What It Means for Your Business and How to Respond

Introduction

A newly disclosed critical vulnerability in a widely used open-source AI workflow tool demands attention from business leaders across the United States and Canada. CVE-2026-68771 affects ComfyUI, a popular platform for building and running generative AI pipelines. Organizations that rely on this software for content creation, research, product development, or customer-facing AI features may face serious exposure. Attackers can exploit the flaw remotely without needing credentials, potentially gaining control of the system running the software. This post explains why the issue matters to your operations, outlines who is most at risk, and provides clear guidance on assessing impact and taking action. Technical details appear only in the appendix for specialists who need them.

S1 — Background & History

CVE-2026-68771 was publicly disclosed on July 31, 2026. The vulnerability impacts ComfyUI versions up through 0.23.0. It was reported by researcher Bofei Chen. The flaw carries a CVSS score of 9.8 under version 3.1 and 9.3 under version 4.0, placing it in the critical severity category. In plain language, the issue allows an unauthenticated attacker to run arbitrary code on a vulnerable system by tricking the software into processing a specially crafted data file. Key timeline events include the identification of the unsafe handling of certain training dataset files, the release of a fix via a code change in June 2026 that was later formalized in the public CVE record, and subsequent advisories from vulnerability databases confirming the remote code execution potential. Organizations using ComfyUI in production or development environments should treat this as a high-priority concern given the ease of exploitation and the privileges typically held by the process.

S2 — What This Means for Your Business

If your organization uses ComfyUI for AI model workflows, this vulnerability creates direct risks to daily operations, sensitive data, reputation, and regulatory standing. An attacker who gains control of the system can disrupt or halt AI pipelines that support product development, marketing content generation, or research efforts. Confidential training data, proprietary models, customer information, or internal intellectual property stored on or accessible from the affected server may be stolen or altered. A successful compromise can lead to public disclosure of the breach, damaging customer trust and brand reputation in competitive markets across the United States and Canada. From a compliance perspective, organizations subject to frameworks such as those governing personal data protection or industry-specific security standards may face notification requirements, audits, or penalties if the incident results in unauthorized access to regulated information. Even teams that treat ComfyUI as an internal development tool rather than a customer-facing service remain exposed if the instance is reachable over the network. The combination of no authentication requirement and high impact means the window for effective response is limited once the software is identified as vulnerable.

S3 — Real-World Examples

Creative Agency Pipeline Disruption: A mid-sized digital marketing firm in Toronto relies on ComfyUI to generate visual assets for client campaigns. An attacker exploits the vulnerability on an internet-exposed instance, executes code, and encrypts project files. Campaign deadlines are missed, client relationships suffer, and the firm incurs emergency recovery costs while restoring from backups.

Regional Bank Research Environment: A regional bank in the Midwest maintains an internal ComfyUI server for exploring generative AI applications in fraud detection research. The server processes datasets that include sensitive transaction patterns. Compromise allows the attacker to exfiltrate data or install persistent access, triggering internal investigation costs and potential regulatory scrutiny under financial data protection rules.

Healthcare AI Startup Exposure: A small health-tech company in British Columbia uses ComfyUI to prototype image analysis models for medical imaging support tools. The vulnerable system holds de-identified but still regulated patient-related training data. Successful exploitation leads to unauthorized access, forcing a privacy incident assessment and temporary suspension of development work.

E-Commerce Product Visualization Team: An online retailer operating across the United States deploys ComfyUI for automated product image enhancement. An unauthenticated attack takes over the processing server during peak season, interrupting the content pipeline and delaying product listings, which directly affects sales volume and customer experience metrics.

S4 — Am I Affected?

• You are running ComfyUI version 0.23.0 or any earlier version.
• Your ComfyUI instance is reachable over the network from untrusted locations, including the public internet or shared corporate networks.
• The LoadTrainingDataset functionality or related workflow nodes that process dataset shard files are enabled or available in your configuration.
• Your deployment accepts file uploads through the standard image upload endpoint without additional access controls.
• You have not yet applied the official code change that restricts unsafe loading of training dataset files.
• The process running ComfyUI has access to sensitive data, models, or other systems beyond the immediate application environment.

Key Takeaways

• CVE-2026-68771 is a critical remote code execution vulnerability in ComfyUI that requires no authentication and can fully compromise affected systems.
• Businesses using this software for AI workflows face risks to operations, data confidentiality, reputation, and compliance obligations.
• Real-world impact can range from disrupted creative pipelines to regulatory exposure in regulated industries.
• Organizations should immediately determine whether they run a vulnerable version and whether the instance is network-accessible.
• Prompt patching combined with access restrictions significantly reduces exposure and supports broader cybersecurity resilience.

Call to Action

Do not leave your AI infrastructure exposed to known critical flaws. Contact IntegSec today for a targeted penetration test that identifies this vulnerability and related weaknesses across your environment. Our team helps organizations in the United States and Canada reduce cybersecurity risk through practical, business-focused assessments. Visit https://integsec.com to schedule a consultation and strengthen your defenses before attackers take advantage of open doors.

TECHNICAL APPENDIX (security engineers, pentesters, IT professionals only)

A — Technical Analysis

The root cause is unsafe deserialization of untrusted data in the LoadTrainingDataset node located in comfy_extras/nodes_dataset.py. The node invokes torch.load on attacker-controlled shard_*.pkl files without the weights_only=True parameter. On PyTorch versions where the default remains False, this permits unrestricted pickle deserialization. An attacker uploads a malicious pickle via the unauthenticated POST /upload/image endpoint, then triggers processing through POST /prompt with a workflow graph referencing the file. The pickle reduce method executes arbitrary Python code under the privileges of the ComfyUI process user. Attack vector is network, complexity is low, privileges required are none, and user interaction is none. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The issue is tracked as CWE-502. Official references include the CVE record and the vendor pull request that introduced the fix.

B — Detection & Verification

Version enumeration can be performed by inspecting the ComfyUI installation directory for the version string in the package metadata or by querying the running instance’s status endpoint if available. Vulnerability scanners should flag ComfyUI instances at or below 0.23.0 when the LoadTrainingDataset node is present. Log indicators include unexpected POST requests to /upload/image containing files with .pkl extensions or filenames matching shard_*.pkl patterns, followed closely by POST /prompt requests that reference those filenames. Behavioral anomalies include sudden execution of unfamiliar Python processes or shell commands originating from the ComfyUI user context. Network exploitation indicators consist of sequential unauthenticated requests to the two endpoints from the same source, especially when the uploaded content is not a valid image. Proof-of-concept code publicly available for this CVE can be used in controlled lab environments to confirm exploitability after version verification.

C — Mitigation & Remediation

1. Immediate (0–24h): Upgrade ComfyUI to a version containing the fix from commit 94ee49b (pull request #14543), which adds weights_only=True to the torch.load call in the LoadTrainingDataset node. If immediate upgrade is not possible, restrict network access to the /upload/image and /prompt endpoints using firewall rules, reverse proxy authentication, or network segmentation so that only trusted internal sources can reach them.
2. Short-term (1–7d): Audit all running ComfyUI instances for version compliance, review upload directories for unexpected .pkl files, and rotate any credentials or secrets that the ComfyUI process could have accessed. Implement monitoring for the specific endpoint sequence associated with exploitation.
3. Long-term (ongoing): Maintain a regular patch cadence for ComfyUI and its dependencies, enforce the principle of least privilege for the process account, and require authentication or network-level controls on all administrative and upload interfaces. Prefer configurations that disable unused nodes such as LoadTrainingDataset when not required for production workflows. Official vendor guidance prioritizes the patched release; interim controls should remain in place until the upgrade is confirmed across all environments.

D — Best Practices

• Never allow unauthenticated file upload endpoints to accept arbitrary file types, especially serialized formats such as pickle.
• Always invoke torch.load with weights_only=True or equivalent safe deserialization options when loading data from untrusted or user-supplied sources.
• Segment AI workflow tools from production data stores and limit the privileges of the service account running the application.
• Monitor and alert on sequential upload-and-execute patterns against known vulnerable endpoints.
• Maintain an inventory of all generative AI tools in use and subscribe to security advisories for those projects so that critical patches are applied promptly.