CVE-2026-118684

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in checkhash that silently returns True when hashval is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives...

CVE-2026-118684 MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in checkhash that silently returns True when hashval is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives...

EUVD-2026-112389

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in checkhash that silently returns True when hashval is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives...

CVE-2026-118684

Versions of MONAI before 1.6.1 are vulnerable to an insufficient integrity verification flaw in the check_hash() function. The vulnerability occurs because the function silently returns True when the hash_val is None , and it uses MD5 as the default hash type. This allows attackers to perform man...