CVE-2026-68771 is a critical remote code execution vulnerability in ComfyUI v0.23.0 caused by unsafe deserialization of untrusted data. Attackers can upload a malicious shard_*.pkl file without authentication through the /upload/image endpoint. Subsequently, by referencing this file in a workflow graph submitted to the /prompt endpoint, the application uses torch.load to deserialize the attacker-controlled pickle payload. This deserialization leverages the __reduce__ method to execute arbitrary Python code with the privileges of the ComfyUI process user. The vulnerability arises from the LoadTrainingDataset node's unsafe handling of pickle files. No official patch or remediation guidance has been provided yet.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary Python code on the ComfyUI server with the privileges of the ComfyUI process user. This can lead to full system compromise, data theft, or further attacks within the environment. The vulnerability has a CVSS 4.0 score of 9.3 (critical), reflecting its high impact and ease of exploitation without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the ComfyUI service to trusted users only and consider disabling or restricting the /upload/image and /prompt endpoints to prevent unauthenticated uploads and workflow queuing. Monitor for unusual activity related to these endpoints and avoid processing untrusted pickle files.