CVE-2026-56315: picklescan - Remote Code Execution via Unblocked Standard Library Modules

Synopsis

An authentication bypass in picklescan's safety validation allows an attacker to achieve remote code execution by crafting a malicious pickle file that imports unblocked Python standard library modules. The vulnerability is reachable over the network with no authentication required, as reflected in the CVSS v4.0 vector (AV:N, PR:N, UI:N). Successful exploitation gives the attacker arbitrary command execution on the host running picklescan, with full impact to confidentiality, integrity, and availability. A patched-image rebuild at version 1.0.4 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to deliver a crafted pickle file to a service running picklescan over the network.

• AuthenticationNot required

  No credentials or account are needed to submit a malicious pickle file that triggers the bypass.

• Victim interactionNot required

  No user action is required; the exploit fires when picklescan processes the crafted file.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race conditions, memory layout dependencies, or environmental prerequisites are involved (AC:L, AT:N).

Blast Radius

• The attacker executes arbitrary operating system commands on the host running picklescan, with the privileges of the process.
• All data accessible to that process, including stored secrets, credentials, and model files, is readable by the attacker.
• The attacker can write, modify, or delete files and data accessible to the process, including poisoning model artifacts in place.
• The picklescan process and any dependent services can be crashed or kept unavailable at the attacker's discretion.