On this page (7 sections)
A GitHub-reviewed advisory describes a flaw in MONAI, the open source medical imaging AI framework, that lets an unauthenticated remote attacker crash a running MONAILabel server or silently corrupt its inference results. The trigger is a single crafted DICOM file of roughly 132 KB sent to the REST API, according to the GitHub advisory.
If you run MONAILabel, host it for a research group or clinic, or manage servers that do, the practical question is simple: is the server reachable from networks you do not control, and is monai older than 1.6.1? Only one independent publisher covers this story so far, so the details below come from that advisory.
What happened
The advisory, published on October 13, 2026 and updated on October 27, 2026, says MONAILabel accepts DICOM uploads over its REST API without authentication in the default deployment. A file with invalid numeric values in certain spatial fields is stored and then breaks the inference pipeline when someone runs a model on it.
The impact has two sides. The first is denial of service: the advisory reports that each crafted request consumed about 16 seconds of compute in its test before the server returned an error. The second is integrity: the advisory title and summary say results can be silently corrupted, because the bad values flow through the spatial transforms and the model without being rejected.
Technical details: three layers that trust each other
The advisory describes the problem as a chain in which each layer assumes the one before it did the checking.
- pydicom: Decimal String (DS) values are meant to contain only digits, plus, minus, period and the letter e. The advisory says pydicom's DS handling passes input to Python's float(), which also accepts strings such as NaN and inf. The validity check only runs in RAISE mode, while the default is WARN, which still returns the invalid value. The advisory states this affects pydicom versions from 0.9.7 through 3.0.2, and that a related bypass exists in the Integer String (IS) type, which accepts…
- MONAI core: the advisory says PydicomReader builds its affine transformation matrix from pixel spacing and position fields with no isfinite() or isnan() checks, so a NaN spreads through every later spatial transform.
- MONAILabel REST API: the upload endpoint accepts DICOM files with no authentication in the default deployment and no validation or bounds checking of tag values.
In plain terms, this is an input validation failure. Numbers that are not real numbers get treated as real measurements, and the software keeps calculating with them. A crash is the loud outcome. Quietly wrong output is the more worrying one in a medical imaging context.
Who is realistically exposed
The attacker needs only network access to the server, which by default listens on port 8000, per the advisory. Exposure is highest when:
- MONAILabel runs with default settings and no authentication in front of it.
- The port is published to the internet or a broad internal network, for example through a container port mapping or a permissive cloud security group.
- The server is shared by several users or feeds results into workflows where nobody re-checks the output.
A server reachable only from a trusted, access-controlled network is at lower risk, but not zero: any user or compromised machine on that network can send the upload.
How to check your exposure
First, find out which monai version is installed. This read-only command, run in the Python environment that runs MONAILabel, prints the installed version. Anything below 1.6.1 is affected.
pip show monaiIf you run MONAILabel in a container, check inside the container instead. This prints the monai package details; replace the placeholder with your container name and look for a version of 1.6.1 or later.
docker exec <container-name> pip show monaiNext, confirm who can reach the server. From a machine outside your trusted network, this sends a harmless GET request to the info endpoint on port 8000. A JSON response from an untrusted network means the API is exposed.
curl -sS -m 10 http://<your-server>:8000/info/You can also review the datastore for unexpected DICOM files uploaded by people or systems you do not recognize, and check server logs for repeated HTTP 500 errors on inference requests, which the advisory associates with the crash.
What to do now
The advisory lists monai 1.6.1 as the patched version. Upgrade first, then reduce exposure.
This upgrades the monai package to the patched release. Run it in the MONAILabel Python environment, restart the service, then confirm with pip show monai that the version is 1.6.1 or later.
pip install --upgrade "monai>=1.6.1"0 of 7 done
Detection and monitoring afterwards
Because corrupted output can be silent, add sanity checks around results, such as rejecting segmentations or measurements that contain non-finite values or look implausible. Keep access logs for the upload and inference endpoints, and alert on uploads from unfamiliar addresses.
If the server sits behind a public hostname, certificate and header-change monitoring helps you notice when a front-end proxy changes, and a web application firewall can add a layer of request filtering in front of an API. Neither replaces patching or authentication. For wider guidance, see website security for small business.
Timeline
| Date | Event |
|---|---|
| Oct 13, 2026 | Advisory published in Project-MONAI/MONAI |
| Oct 27, 2026 | Advisory updated |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.