External risk intelligence

ComfyUI LoadTrainingDataset Unsafe Deserialization RCE

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-68771

ComfyUI is typically deployed as a local-only or internal development/research tool for image generation workflows. While it exposes network endpoints that could be reached if explicitly exposed to the internet, public-facing deployment is not the standard or intended use case for this type of local workflow engine.

Deserialization

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in ComfyUI that could allow unauthenticated remote attackers to execute arbitrary Python code. This occurs through a feature designed for loading training datasets, where uploading a specially crafted file can lead to the execution of malicious commands. The main concern is to determine if this technology is in use and exposed within our environment.

Unsafe code execution via data loading.
Confirms potential for remote command execution.
Assess relevance and exposure of ComfyUI.

Attack Path

How an attacker could exploit the issue

An attacker can remotely execute arbitrary Python code by uploading a specially crafted file and tricking the system into loading it. This process begins with an unauthenticated user uploading a malicious pickle file disguised as a training dataset shard. The attacker then triggers a workflow that processes this file, leading to the deserialization of the malicious payload and subsequent arbitrary code execution as the user running the ComfyUI application.

Unauthenticated remote access required.
Uploading crafted pickle file triggers vulnerability.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When ComfyUI is configured to be accessible over a network, an unauthenticated attacker could execute arbitrary Python code by uploading a malicious pickle file and triggering its deserialization through the LoadTrainingDataset node. This could lead to the compromise of the ComfyUI process, affecting system data.

Arbitrary code execution.
Unauthenticated network upload and execution.
Compromise of ComfyUI process.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ComfyUI's LoadTrainingDataset node requires immediate attention from teams managing the application and its underlying infrastructure. The first practical step is to inventory all instances of ComfyUI, determine their reachability and business criticality, and identify the specific teams or individuals accountable for these assets before planning remediation.

Application owners must own the issue.
Verify ComfyUI instance reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ComfyUI?

ComfyUI is a popular, node-based graphical user interface for Stable Diffusion. It allows users to build and execute complex image generation workflows by connecting different components together. Because it is highly extensible and designed for experimentation, it is frequently used by researchers and artists to manage local deep learning tasks, often running on workstations where custom Python modules are processed.

What does CWE-502 mean for CVE-2026-68771?

CWE-502 is the weakness class for 'Deserialization of Untrusted Data.' In this specific case, it means the application automatically trusts and interprets data structures within a file without verifying their contents first. Because the software uses Python's pickle format to load training data, a malicious file can include instructions that tell the system to run arbitrary commands rather than simply reading the intended data.

How is this vulnerability triggered?

An attacker triggers this by first uploading a malicious pickle file through the software's image upload endpoint. The vulnerability is only activated if the user then queues a specific workflow that utilizes the 'LoadTrainingDataset' node to process that file. Simply uploading the file is insufficient; the system must be instructed to load and deserialize it for the malicious code to execute.

Is my ComfyUI instance at risk?

According to Halo Surface Signal, this software is typically meant for local or internal use. While it is not intended to be exposed to the public internet, any instance that is inadvertently reachable via a network could be targeted. You should verify if your instance is restricted to local connections or if it has been exposed to wider network access, as remote, unauthenticated access significantly increases the risk.

What should I do if I run ComfyUI?

Begin by inventorying all instances of ComfyUI within your environment to understand where they are running and who is responsible for them. Once identified, assess whether each instance is accessible over a network. Prioritize restricting network access to these services while you work with your team to review official updates or configuration changes that address the underlying deserialization flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.