ComfyUI LoadTrainingDataset Unsafe Deserialization RCE

Technical Analysis

The vulnerability stems from unsafe use of torch.load() in the LoadTrainingDataset node, which deserializes pickle files without validation, allowing attacker-controlled __reduce__ methods to execute arbitrary Python/OS commands. Exploitation requires only two unauthenticated HTTP requests: a POST to /upload/image to plant a crafted shard_*.pkl payload, followed by a POST to /prompt to queue a workflow graph that references and deserializes the malicious file. With a CVSS score of 9.8, this is trivially weaponizable and requires no user interaction or privileges, making it ideal for mass scanning and automated exploitation. ComfyUI is frequently deployed as a backend component in AI agent pipelines, RAG-adjacent generative workflows, and multi-tool orchestration systems (e.g., agents that call image-generation tools), meaning a compromised ComfyUI instance could grant attackers a foothold to pivot into broader agent infrastructure, exfiltrate API keys/credentials used by co-located agent processes, or poison downstream generative outputs consumed by autonomous pipelines.

Affected Systems

ComfyUI v0.23.0 and potentially earlier versions using the LoadTrainingDataset node; any self-hosted or cloud-deployed ComfyUI instance exposing the /upload/image and /prompt endpoints without authentication or network restriction.

Indicators of Compromise

• shard_*.pkl (malicious pickle filename pattern)
• POST /upload/image (anomalous unauthenticated upload requests)
• POST /prompt (workflow queue referencing attacker-uploaded shard files)
• Unexpected child processes spawned by ComfyUI process user
• Outbound connections from ComfyUI host shortly after /prompt requests

Remediation Steps

1. 1

   Upgrade ComfyUI

   Apply the vendor patch or upgrade to a fixed version of ComfyUI once released; monitor vendor advisories for CVE-2026-68771.

2. 2

   Restrict network exposure

   Do not expose ComfyUI's web interface (including /upload/image and /prompt endpoints) directly to the internet; place it behind authentication, a VPN, or a reverse proxy with access controls.

3. 3

   Sandbox the process

   Run ComfyUI in an isolated container or VM with least-privilege permissions, no access to sensitive credentials, and restricted outbound network access.

4. 4

   Disable unsafe deserialization

   Replace torch.load-based pickle deserialization with safetensors or other safe serialization formats for dataset/model loading where possible.

5. 5

   Monitor and audit

   Enable logging on upload and prompt endpoints, and alert on unusual pickle file uploads or unexpected process spawning from the ComfyUI service.

6. 6

   Rotate exposed credentials

   If ComfyUI shares a host or environment with AI agents holding API keys or secrets, rotate those credentials and audit for signs of lateral movement.