CVE-2026-44484
CVE-2026-44484 · Compromise of PyTorch Lightning PyPi Package Versions
This page contains facts from public vulnerability sources. Check the original advisory before updating.
PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.
CVSS 9.3 · Critical · EPSS 0.7% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
pytorch-lightning
- Versions
- 2.6.2: Affected
- 2.6.3: Affected
No fix published
pytorch-lightning PyPI
- Versions
- 2.6.2
No fix published
pytorch-lightning PyPI
- Versions
- 2.6.3
No fix published
lightning PyPI
- Versions
- 2.6.2
- 2.6.3
- Affected ranges
- ECOSYSTEM: ≥ 2.6.2, < 2.6.4
Update to 2.6.4
pytorch-lightning PyPI
- Versions
- 2.6.2
- 2.6.3
- Affected ranges
- ECOSYSTEM: ≥ 2.6.2, < 2.6.4
Update to 2.6.4
Original sources
- https://github.com/Lightning-AI/pytorch-lightning/security/advisories/GHSA-w37p-236h-pfx3
- https://access.redhat.com/security/cve/CVE-2026-44484
- https://bugzilla.redhat.com/show_bug.cgi?id=2477476
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44484.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-44484