CVE-2026-68771Disclosure

LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

Back to dashboard

0.5/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

RISING

Threat summary

Patch or workaround signal is available
9 mentions across 5 observed days
Momentum state: rising

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 7 signals
Disclosure: 6 classified signals
Peaked 1d ago at 4 mentions (2026-08-03); latest day: 2
9 total mentions across 5 days

Deep dive

Activity timeline9 mentions / 5d

Signal classification2 categories

Disclosure

685.7%

Patch

114.3%

Referenced assets10 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-31	1	Disclosure1
2026-08-01	1	Disclosure1
2026-08-02	1	Disclosure1
2026-08-03	4	Disclosure3Patch1

Full discourse9 posts

FOFA@fofabot44d
Disclosure
⚠️⚠️ CVE-2026-68771 (CVSS 9.8): Unauthenticated RCE via unsafe pickle deserialization in ComfyUI v0.23.0. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJDb21meVVJIg== 🎯419.2K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="ComfyUI" 🔖Refer: https://nvd.nist.gov/vuln/detail/CVE-2026-68771 #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The post announces a high‑severity RCE vulnerability (CVE‑2026‑68771) in ComfyUI v0.23.0, providing technical details and a FOFA query link, but it does not offer a PoC, exploit code, or patch information.
0280753910.1K
14.8K followersView on X
Autumn Good@autumn_good_3544d
Disclosure
🚨🚨🚨 『allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization.』 CVE-2026-68771 ComfyUI v0.23.0 contains an unsafe deserialization... https://github.com/advisories/GHSA-6p72-9j26-4rmx
Post summary
The advisory announces CVE-2026-68771, detailing an unsafe deserialization flaw in ComfyUI v0.23.0 that permits unauthenticated remote attackers to execute arbitrary Python code via crafted pickle files, but provides no PoC, exploit code or patch details.
00001464
7.0K followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-68771 ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Pyt… https://www.cve.org/CVERecord?id=CVE-2026-68771
Post summary
The entry announces CVE-2026-68771, noting an unsafe deserialization vulnerability in ComfyUI v0.23.0 that permits unauthenticated remote code execution via the LoadTrainingDataset node.
00010805
58.1K followersView on X
IntegSec@integ_sec1d
CVE-2026-68771: ComfyUI Unsafe Deserialization Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04xmkPR0
0000029
35 followersView on X
NEXSIGHT@NEXSIGHTNEWS1d
AI画像生成ツール「ComfyUI」に未認証で任意コード実行が可能な脆弱性（CVE-2026-68771、CVSS 9.8）— 修正はv0.26.0以降、それ以前のバージョンは更新を https://cyber.nexsight.co/articles/2026/09/14/comfyui-cve-2026-68771-loadtrainingdataset-pickle-rce-2026-09-14/
0000060
65 followersView on X
lee1981@lee1981b43d
Disclosure
🔥 CyberForge CVE of the Day #014 🚨CVE-2026-68771 Is a critical unsafe-deserialization vulnerability affecting the LoadTrainingDataset node in ComfyUI leading to unauthenticated RCE. A crafted pickle shard can reach torch.load() through the upload + workflow APIs, executing code as the ComfyUI user. An unauthenticated attacker can upload a malicious pickle shard, trigger LoadTrainingDataset via the workflow API and execute code as the ComfyUI user. ⭐ CVSS 9.8 ⭐ CVSS v4.0: 9.3 Critical ⭐ CVSS v3.1: 9.8 Critical ⭐ CWE-502: Deserialization of Untrusted Data The vulnerable functionality sits inside comfy_extras/nodes_dataset.py more specifically, it affects the LoadTrainingDataset.execute() method. Affected Versions: up to and including 0.23.0 🔗https://nvd.nist.gov/vuln/detail/CVE-2026-68771 #ComfyUI #RCE #AISecurity #BlueTeam #CyberForge #CVE
Post summary
A critical unsafe‑deserialization vulnerability (CVE‑2026‑68771) in ComfyUI’s LoadTrainingDataset node allows unauthenticated RCE via malicious pickle shards, with high CVSS scores, but no patch or exploit details are disclosed.
0000085
540 followersView on X
ThreatAft@ThreatAft44d
Patch
🔐🚨 ComfyUI RCE — CVSS 9.8 CVE-2026-68771: Unauthenticated pickle deserialization in LoadTrainingDataset node allows arbitrary Python code execution. Update to latest patched version NOW. → http://threataft.com/articles/comfyui-cve-2026-68771 #cybersecurity #infosec #ComfyUI #AI #ML #ThreatIntel
Post summary
The tweet announces the ComfyUI CVE‑2026‑68771 vulnerability, highlights its severe impact, and urges users to apply the latest patch, without providing PoC or exploit details.
0000088
36 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters45d
Disclosure
CVE-2026-68771 - Critical RCE in ComfyUI. Unsafe deserialization in LoadTrainingDataset. CVSS 9.8. No patch; stop using /upload/image and /prompt. #CVE #ComfyUI #infosec #cybersecurityawareness #cybersecurity #cybersecuritytips #cybersecurityalert #cybersecuritynews #devsecops #devops #developer #redteam #blueteam #git #github #gitlab #cvealert #linux https://www.valtersit.com/cve/CVE-2026-68771/
Post summary
The post announces a critical RCE vulnerability (CVSS 9.8) in ComfyUI’s LoadTrainingDataset caused by unsafe deserialization and notes that no patch exists, advising users to avoid the /upload/image and /prompt endpoints.
0000082
980 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds46d
Disclosure
CVE-2026-68771 Unsafe Deserialization Remote Code Execution in ComfyUI v0.23.0 LoadTrainingDataset https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-68771
Post summary
CVE-2026-68771 is a newly disclosed vulnerability that allows remote code execution via unsafe deserialization in ComfyUI v0.23.0; no PoC, exploit, or patch details are included in the brief mention.
00000119
4.1K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-68771

FOFA[verified]@fofabotDisclosure

The post announces a high‑severity RCE vulnerability (CVE‑2026‑68771) in ComfyUI v0.23.0, providing technical details and a FOFA query link, but it does not offer a PoC, exploit code, or patch information.

lee1981[verified]@lee1981bDisclosure

A critical unsafe‑deserialization vulnerability (CVE‑2026‑68771) in ComfyUI’s LoadTrainingDataset node allows unauthenticated RCE via malicious pickle shards, with high CVSS scores, but no patch or exploit details are disclosed.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersDisclosure

The post announces a critical RCE vulnerability (CVSS 9.8) in ComfyUI’s LoadTrainingDataset caused by unsafe deserialization and notes that no patch exists, advising users to avoid the /upload/image and /prompt endpoints.

Autumn Good@autumn_good_35Disclosure

The advisory announces CVE-2026-68771, detailing an unsafe deserialization flaw in ComfyUI v0.23.0 that permits unauthenticated remote attackers to execute arbitrary Python code via crafted pickle files, but provides no PoC, exploit code or patch details.

CVE@CVEnewDisclosure

The entry announces CVE-2026-68771, noting an unsafe deserialization vulnerability in ComfyUI v0.23.0 that permits unauthenticated remote code execution via the LoadTrainingDataset node.

ThreatAft@ThreatAftPatch

The tweet announces the ComfyUI CVE‑2026‑68771 vulnerability, highlights its severe impact, and urges users to apply the latest patch, without providing PoC or exploit details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

CVE-2026-68771 is a newly disclosed vulnerability that allows remote code execution via unsafe deserialization in ComfyUI v0.23.0; no PoC, exploit, or patch details are included in the brief mention.