CVE-2026-7584: LabOne Q Deserialization Leads to Arbitrary Code Execution

The National Vulnerability Database highlights CVE-2026-7584, a critical deserialization vulnerability within LabOne Q’s serialization framework. This flaw, rated 7.8 (HIGH) on the CVSS scale, stems from the import_cls mechanism, which dynamically imports and instantiates Python classes during deserialization. Prior to the patch, this mechanism accepted unvalidated, arbitrary fully-qualified class names from serialized data, lacking any restrictions on module imports.

An attacker could exploit this by crafting a malicious serialized experiment file. When loaded by a victim using LabOne Q’s deserialization functions—for instance, a compromised file shared for collaboration or support—it would force the engine to import and instantiate arbitrary Python classes with attacker-controlled constructor arguments. This directly leads to arbitrary code execution within the context of the user running the Python process.

This is a classic CWE-502 vulnerability. It underscores the danger of unchecked deserialization, where trusted data structures can be weaponized to execute hostile code. Defenders need to recognize that seemingly benign file exchanges, even within trusted circles, can become vectors for severe compromise if underlying software libraries are not robustly secured against such deserialization abuses.