CVE-2026-44484

According to the description, version 2.6.2 of the PyTorch Lightning library introduces code whose behavior is consistent with a credential harvesting mechanism – i.e., unauthorized interception of user or environment credentials. CWE-506 indicates embedded malicious code in a software package. An attacker or compromised supply chain could have introduced such functionality directly into the library distribution.

An attacker can gain access to credentials (e.g., API keys, tokens, passwords) stored in the environment where the library is running, which can lead to account takeover, data leakage, and further compromise of infrastructure.

Immediately remove PyTorch Lightning version 2.6.2 from all environments and do not install this version. Apply patches available from the vendor in accordance with the references (GitHub Security Advisory GHSA-w37p-236h-pfx3). It is also recommended to audit environments where version 2.6.2 was installed for potential credential leakage.

PyTorch Lightning version 2.6.2