High [CVE-2026-58659] Remote code execution via malicious checkpoint files

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters.

Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called. This vulnerability allows attackers to achieve remote code execution by crafting malicious checkpoint files.

The vulnerability arises from the _load_state function's ability to import and execute attacker-controlled module names from maliciously crafted checkpoint files, even when weights_only=True is enabled. Exploitation requires a local attacker to trick a user into loading a specially crafted checkpoint file.

Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-502.

Affected Red Hat products: Red Hat AI Inference Server 3.3; Red Hat AI Inference Server 3.4; Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat lists Red Hat OpenShift AI (RHOAI) as not affected.

Will not fix / out of support: Red Hat AI Inference Server. Red Hat fixing advisory: RHSA-2026:68698, RHSA-2026:68699, RHSA-2026:69466, RHSA-2026:69467, RHSA-2026:70965, RHSA-2026:70979.