Vulnerability · Published May 14, 2026 · Assigned by GitHub_M
CVE-2026-44484Compromise of PyTorch Lightning PyPi Package Versions
Critical 9.8
In plain English
A critical-severity security flaw in pytorch-lightning from Lightning-AI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.4%top 66.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | lightning | 2.6.4 | PYSEC-2026-3973 |
| PyPI | pytorch-lightning | no fix listed | GHSA-w37p-236h-pfx3 |
| PyPI | pytorch-lightning | no fix listed | GHSA-w37p-236h-pfx3 |
| PyPI | pytorch-lightning | 2.6.4 | PYSEC-2026-508 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lightning-AI | pytorch-lightning | 2.6.22.6.3 |
Weakness: CWE-506, CWE-829 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/Lightning-AI/pytorch-lightning/security/advisories/GHSA-w37p-236h-pfx3 x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-44484 vdb-entry, x_refsource_REDHAT
- RHBZ#2477476 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44484.json x_sadp-csaf-vex