CVE-2026-47117: OpenMed < 1.5.2 Remote Code Execution via PII Model Loading

Synopsis

Remote code execution via unsafe model loading affects OpenMed versions before 1.5.2. The vulnerability is reachable over the network with no authentication required: an attacker supplies a crafted model name that tricks the privacy-filter dispatcher into loading an arbitrary Hugging Face repository with trust_remote_code=True, causing the attacker's custom Python code to execute with the privileges of the OpenMed service process. A patched-image rebuild at version 1.5.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable model-loading endpoint is exposed over the network, so the attacker must be able to send HTTP requests to the OpenMed service.

• AuthenticationNot required

  No account or credential is needed; the malicious model_name parameter can be submitted by any unauthenticated caller.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from a logged-in user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race condition, memory layout dependency, or special environmental state is required beyond being able to reach the service.

Blast Radius

• Attacker-supplied Python code executes with the full privileges of the OpenMed service process, enabling arbitrary command execution on the host.
• All data accessible to the service process, including patient PII and any credentials or secrets mounted into the container, is readable by the attacker.
• The attacker can write or delete files, modify application state, or install persistent tooling within the container filesystem.
• The running service and any co-located workloads sharing the same process namespace are subject to disruption or takeover.