Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-05T12:26:27 peft: peft: Arbitrary Code Execution via Unsafe Deserialization in LoRA-GA and CorDA Modules 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-502

Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load() on config-specified cache/covariance files without weights_only=True, bypassing peft's own safe-loading wrapper used elsewhere in the codebase. Because torch.load() without weights_only=True performs full pickle deserialization, loading a malicious cache or covariance file (e.g. a shared/downloaded LoRA-GA or CorDA cache) results in arbitrary code execution.

A flaw was found in peft. The LoRA-GA and CorDA initialization modules within Hugging Face peft improperly call `torch.load()` without the `weights_only=True` parameter. This oversight allows for full pickle deserialization when loading a malicious cache or covariance file. A remote attacker could exploit this by tricking a user into loading a specially crafted file, leading to arbitrary code execution on the affected system.

Red Hat ships Hugging Face peft (versions up to 0.19.1, all within the vulnerable range) across multiple AI/ML product images: OpenShift AI (RHOAI), the AI Inference Server (vLLM ROCm), RHEL AI, and Lightspeed Stack. The LoRA-GA and CorDA initialization modules call torch.load() on config-specified cache/covariance files without weights_only=True, enabling full pickle deserialization and arbitrary code execution if a malicious cache file is loaded. Resolution is delegated to each image's maintainers to update the pinned peft dependency; trackers have been filed against all affected streams. Do not load LoRA-GA or CorDA cache/covariance files from untrusted or unverified sources; only use cache files generated in your own trusted training environment. Upgrade to a peft release newer than 0.19.1 once available in the affected image. Lightspeed Core Affected lightspeed-core/lightspeed-stack-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-rocm-rhel9 Red Hat AI Inference Server Affected rhaii/vllm-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-azure-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-caikit-nlp-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-caikit-tgis-serving-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-autogluon-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-openvino-model-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-ta-lmes-job-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda121-torch24-py311-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda124-torch25-py311-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda128-torch28-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda128-torch29-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-rocm62-torch24-py311-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-rocm62-torch25-py311-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-rocm64-torch28-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-rocm64-torch29-py312-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-71281 https://nvd.nist.gov/vuln/detail/CVE-2026-71281 https://github.com/huggingface/peft https://github.com/huggingface/peft/blob/main/src/peft/tuners/lora/corda.py