CVE-2026-57845
Description
A flaw was found in datasets. This vulnerability allows an attacker to achieve arbitrary code execution by convincing a victim to load a maliciously crafted dataset file. Due to insecure deserialization—the process of restoring saved data back into program objects—untrusted data loaded through the pandas dataset builder is processed without validation. Consequently, opening a malicious file executes arbitrary Python code with the privileges of the running process.
Statement
This vulnerability is rated as Important severity because successful exploitation enables arbitrary code execution within the host or container environment, though it is constrained by requiring user interaction to ingest untrusted data files. In Red Hat environments such as Red Hat OpenShift AI (RHOAI) and RHEL AI, the datasets package is included across multiple machine learning images used for model training and evaluation. Risk is primarily present when workloads or interactive notebook users load third-party datasets that rely on the legacy pandas builder to deserialize pickle objects. Standard container boundaries and non-privileged workload deployment models help contain execution to the specific container context.
Mitigation
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to prevent execution of unvalidated pickle files by removing usage of the legacy pandas packaged builder in datasets and migrating to safe serialization formats like Parquet: upgrade to the fixed Rhoai/Odh Ta Lmes Job Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Training Cuda121 Torch24 Py311 Rhel/Rhoai/Odh Training Rocm62 Torch24 Py311 Rhel/Rhoai/Odh Training Cuda124 Torch25 Py311 Rhel/Rhoai/Odh Training Rocm62 Torch25 Py311 Rhel/Rhoai/Odh Openvino Model Server Rhel/Exploit Intelligence/Vulnerability Analysis Rhel/Lscore Deploy/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Vllm Rocm Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gcp Cuda Rhel/Rhoai/Odh Autorag Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Rocm Rhel/Rhaii Fast/Vllm Spyre Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Ask Sre/Lightspeed Core/Lightspeed Stack Rhel/Rhai/Guidellm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Rhaii Fast/Model Opt Cuda Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Training Cuda128 Torch28 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch28 Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhaii Fast/Vllm Rocm Rhel/Rhoai/Odh Caikit Nlp Rhel/Python Datasets builds, which unconditionally raise a migration error in Pandas._generate_tables() before opening or unpickling any files, closing all 2 injection vectors (crafted pickle dataset file, untrusted pandas packaged builder input). Until patched, this is a concern on Workloads and interactive notebook users ingesting untrusted third-party datasets via the pandas builder across containerized and host environments, so Prohibit invoking datasets.load_dataset with the pandas builder on untrusted data files, and migrate workflows to safe formats such as Parquet, Arrow, CSV, or JSON, or direct construction via Dataset.from_pandas(). As a compensating measure, Enforce a read-only container root filesystem to prevent an executed payload from writing persistence or modifying binaries, Deploy an EDR agent to detect anomalous process spawning or malicious payload behavior launched via deserialization exploits, and Use Falco or eBPF runtime security to detect runtime anomalies such as unexpected shell execution or container escapes. These controls limit blast radius and contain exploitation, but they do not fix the underlying insecure pickle deserialization defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1302 Deserialization Allowlist (Safe Loading) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 8.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data; Unexpected State
Attackers can modify unexpected objects or data that was assumed to be safe from modification. Deserialized data or code could be modified without using the provided accessor functions, or unexpected functions could be invoked.
Availability
Technical Impact: DoS: Resource Consumption (CPU)
If a function is making an assumption on when to terminate, based on a sentry in a string, it could easily never terminate.
Other
Technical Impact: Varies by Context
The consequences can vary widely, because it depends on which objects or methods are being deserialized, and how they are used. Making an assumption that the code in the deserialized object is valid is dangerous and can enable exploitation. One example is attackers using gadget chains to perform unauthorized actions, such as generating a shell.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
