Critical ComfyUI Flaw CVE-2026-68771 Lets Anyone Take Over the Server: Update to v0.26.0

ComfyUI, one of the most widely used tools for generating images with AI, has a serious flaw that lets an attacker take over the server without logging in. The vulnerability is tracked as CVE-2026-68771 and carries a severity of 9.8 out of 10, in the top "critical" band.

The problem sits in the feature that loads training data. By sending a crafted file, an attacker can run any program on the server that runs ComfyUI, and no password or login is required at all. The developers have already shipped a fixed release, v0.26.0, with the latest being v0.29.2. No real-world attack using this CVE has been confirmed yet, but if you expose ComfyUI to the internet, updating quickly is strongly advised.

This article explains, in plain terms, what happens, whether your setup is affected, and what to do.

What ComfyUI is, and what happened

ComfyUI is software that lets you drive image-generating AI by wiring together building blocks with the mouse. Its trademark is a distinctive canvas where you connect boxes (nodes) with lines to assemble an image-generation pipeline based on models like Stable Diffusion. It is popular with people who want fine-grained control. Many run it on their own PC, but plenty also install it on cloud servers equipped with powerful graphics processors (GPUs), and it has become a staple tool in the AI art and AI image communities.

The flaw is in ComfyUI's "load training dataset" feature. According to the VulnCheck advisory that reported it, even an outsider who has not logged in can run any program on the server just by sending a crafted file. Severity here is measured by CVSS, an international 0-to-10 scale for how dangerous a vulnerability is; anything at 9 or above is rated "critical." Here is the summary.

The key detail is the "precondition" column. Most vulnerabilities start with the attacker having some account to log in with. This one does not even need that. If traffic can reach the ComfyUI interface at all, whether from the internet or an internal network, that is enough to become the entry point for a takeover. That is why setups that expose ComfyUI to the outside are the most at risk.

Who targets this, and what they do

The realistic attacker here is someone who is mass-scanning the internet for ComfyUI servers left exposed. ComfyUI was designed to run on your own machine, but in practice many people expose it directly to the internet for collaboration or remote access. Attackers run automated tools that sweep for these unlocked doors every day, and when they find ComfyUI's characteristic network endpoints, they lock on. Because there is no login barrier, once you are targeted they can move straight to the attack with no special setup.

Such an attacker sends a booby-trapped file disguised as image-training data and gets it loaded, which runs their own program on the server. On the surface it looks like an ordinary file exchange, so administrators tend not to notice anything wrong. Once it succeeds, the attacker can operate the server freely.

The damage does not stop inside ComfyUI's screen. For individuals, saved artwork, training material, and login details for other services all become fair game for snooping and theft. For companies and creative teams, an expensive GPU server can be hijacked for cryptocurrency mining, or used as a stepping stone to break into other internal servers. In fact, large numbers of internet-exposed ComfyUI servers have been hijacked in the past (more below). That is why updating and reviewing your exposure settings, covered next, should not be put off.

What happens, and how it works

CVE-2026-68771: arbitrary program execution from loading training data (severity 9.8)

ComfyUI has a "training" feature for tuning an image-generation AI to your taste, and within it a node called LoadTrainingDataset that reads bundled training data (a dataset). The flaw was in how this node reads that file.

The root cause is a Python data format called "pickle." Pickle is convenient, but a pickle file can embed an instruction that says "run this program the moment I am loaded." When reading training data, ComfyUI opened the file with a function called torch.load without the safety switch (weights_only=True) that blocks this behavior. The pull request that fixed it (PR #14543) even notes this was the only place in the entire codebase that loaded a file without that safety switch.

The attack flow goes like this. First the attacker uses a file-upload endpoint that requires no login (/upload/image) to place a crafted data file on the server. Next they ask ComfyUI to process that file with LoadTrainingDataset (/prompt). The moment ComfyUI opens the file, the embedded instruction fires and runs any command on the server under the account that runs ComfyUI. None of this requires a password or administrator rights.

The developers merged a fix commit adding the safety switch on June 18, 2026, and shipped it officially in v0.26.0 on June 23. The finder is Bofei Chen, and the CVE itself was published on July 31.

Why the same hole keeps appearing in AI tools

This vulnerability is less a one-off ComfyUI slip than an example of a structural weakness across AI and machine-learning software. Image and language AIs pass around huge amounts of data and models as files, and the aforementioned pickle format is widely used to store them. Code that loads pickle files carelessly, "because it is convenient," lingers in AI tools everywhere.

Indeed, 2026 alone has seen the same "takeover via unguarded pickle loading" reported one after another: the image generator OmniGen2, NVIDIA's video generator GEN3C, and the large-language-model serving engine sglang. ComfyUI itself has seen similar findings in its model-loading code (issue #12245) and a takeover via file upload in its extension manager, ComfyUI-Manager (CVE-2025-67303).

This kind of attack, poisoning the very files and packages that get distributed, is rising across software development, not just AI. We have covered the poisoning of PyPI, Python's package-distribution site, in the Telnyx case, and the npm chain compromise in the TanStack and Nx Console incident. For an ongoing way to check whether the components you rely on hide dangerous loading routines, see our OSS supply chain scanner roundup.

Are you affected, and what to do

The deciding factor is the version. If your ComfyUI is older than v0.26.0 it is affected; v0.26.0 or later is fixed. You can check the version on ComfyUI's screen or in its startup log.

One caveat about the fixed version. The NVD vulnerability database lists the affected range as "v0.23.0 and earlier." But the fix that actually adds the safety switch landed in v0.26.0, released June 23, and the earlier v0.24.0 and v0.25.x still carried the same dangerous loading routine. Judging by when the fix commit was merged, the safe line is v0.26.0 or later. NVD's "v0.23.0 and earlier" understates the affected range, so treat v0.24.x and v0.25.x as affected too and update.

How you update depends on your setup, but the basics are to pull the latest GitHub release or use ComfyUI's update function. If you cannot update right away, the most effective stopgap is to move ComfyUI somewhere it cannot be reached directly from the internet. Concretely: make it accessible only from inside an internal network or VPN, put an authenticated gateway (such as a reverse proxy) in front so a login is required, and shut the service down when not in use. Because this flaw needs no login, simply keeping the screen out of reach from outside makes a decisive difference.

Is it being exploited yet?

As of August 1, 2026, there is no confirmed report of CVE-2026-68771 itself being used in a real attack. It is not listed in the U.S. CISA catalog of vulnerabilities known to be exploited in the wild (the KEV catalog). That said, the concrete attack flow, which endpoints to use and how to get the file loaded, is already public in the advisory, so it is safest to assume it will not take long for an attack tool to appear.

What cannot be ignored is that ComfyUI has already been targeted before. In 2025, the Chinese security research group XLab reported infections of a backdoor called "Pickai" aimed at internet-exposed ComfyUI servers, with roughly 695 servers confirmed hijacked. The infected servers were abused for remote control and to keep the backdoor in place. It is a clear sign that exposed ComfyUI is a real-world target, so it pays to finish updating and reviewing your exposure "while this CVE is not yet being attacked."

Timeline

← Swipe to move

Summary

ComfyUI, the go-to tool for AI image generation, has a severity-9.8 flaw, CVE-2026-68771, that lets an attacker take over the server without logging in, fixed in v0.26.0. The cause was that the node loading training data opened a dangerous file format (pickle) without a safety switch, so simply sending a crafted file runs any program. No real attack has been reported yet, but the mechanics are public, and internet-exposed ComfyUI servers have been hijacked en masse before. If you run v0.25.1 or earlier, update to v0.26.0 or later before attacks spread, and review your setup so ComfyUI cannot be reached directly from outside. For how to think about dangerous loading routines hiding inside software components, see our OSS supply chain scanner roundup.

References

• ▸ NVD - CVE-2026-68771
• ▸ VulnCheck Advisory - ComfyUI Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization
• ▸ ComfyUI PR #14543 - harden: load training-dataset shards with weights_only=True
• ▸ ComfyUI fix commit (94ee49b)
• ▸ ComfyUI v0.26.0 release
• ▸ ComfyUI issue #12245 (unsafe pickle loading in checkpoint_pickle)
• ▸ GitHub Advisory - ComfyUI-Manager CVE-2025-67303