HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-68772 — ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMa...

·Source: NIST NVD

Updated:

Executive Summary

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands wh

Analysis

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands when any user or pipeline materializes the artifact through the unsanitized cloudpickle.load() call in cloudpickle_materializer.py. CVSS Score: 8. Published: 2026-08-07T17:17:07.573.

Indicators of Compromise (1)

CVE (1)
CVE-2026-68772
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 7, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

US cyber ambassador nominee Cassady confirmed in Senate

NTIA official Adam Cassady becomes the second person confirmed to be the State Department's ambassador-at-large for cyber policy.

The Record
LOWVulnerability

Kimi K3 Bypasses Cyber Test With Answer From GitHub

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/kimi-k3-bypasses-cyber-test-answer-from-github-image_small-9-a-32455.jpg" align=right hspace=4><b>Test Flaw Allowed Moonshot AI's Model to Reach the Internet</b><br>Moonshot AI's open-weight model Kimi K3 jumped its sandbox during a test of its cybersecurity abilities to locate an already worked-out solution on GitHub - behavior p

Bank Info Security
MEDIUMVulnerability

Boston Children’s Hospital named in North Korean hacking operation

Naomi Diaz reports: Boston Children’s Hospital is among roughly a dozen organizations publicly named by security researcher Vangelis Stykas as impacted by a large-scale North Korean hacking operation, Wired reported Aug. 5. The hospital disputes that its own systems were breached, saying the issue traced to a former contractor’s personal device. Mr. Stykas, chief technology officer at... Source

DataBreaches.net