EUVD-2026-25305
GHSA-w598-p4vc-7qcx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network RCE via an exposed no-auth ZMQ socket gives AV:N/AC:L/PR:N/UI:N; arbitrary code execution as the process yields full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
7DescriptionCVE.org
KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. Attackers can send a crafted pickle payload to the exposed ZMQ socket to execute arbitrary code on the server with the privileges of the ktransformers process.
AnalysisAI
Remote code execution in KTransformers through 0.5.3 lets unauthenticated network attackers run arbitrary code by sending a crafted pickle payload to the scheduler RPC service used in balance_serve backend mode. The affected code binds a ZMQ ROUTER socket to all interfaces (0.0.0.0) with no authentication and passes received frames straight into pickle.loads(), so any host that can reach the scheduler port gains code execution as the ktransformers process. Publicly available exploit code exists (VulnCheck/chocapikk write-up) and a vendor upstream fix is available, though the EPSS probability is currently low at 0.04%.
Technical ContextAI
KTransformers is a heterogeneous CPU/GPU LLM inference framework from kvcache-ai. In balance_serve mode it runs an internal scheduler as a separate process that communicates over a ZeroMQ (ZMQ) ROUTER/DEALER RPC channel (sched_rpc.py). The vulnerability is a classic CWE-502 Deserialization of Untrusted Data: the server called pickle.loads() on raw ZMQ frames, and Python's pickle can invoke arbitrary callables (via __reduce__) during deserialization, turning any attacker-controlled byte stream into code execution. Two design faults compounded the risk - the socket bound to tcp://*:{sched_port} (all interfaces rather than loopback) and there was no message authentication. The PR #1944 fix addresses all three: it binds to 127.0.0.1 by default, adds HMAC-SHA256 signing/verification of frames with a shared secret, and replaces pickle.loads with a RestrictedUnpickler allowlisting only safe types plus the C++ scheduler extension objects, while moving KV-cache tensor transport to safetensors. The single affected CPE is cpe:2.3:a:kvcache-ai:ktransformers.
RemediationAI
Apply the upstream fix from GitHub PR https://github.com/kvcache-ai/ktransformers/pull/1944, which binds the scheduler socket to 127.0.0.1 by default, adds HMAC-SHA256 authentication of RPC frames, and replaces pickle.loads with a restricted unpickler - a released patched version number is not independently confirmed from the input, so upgrade to the first tagged release incorporating PR #1944 and set KTRANSFORMERS_RPC_SECRET as the patch requires. Until you can deploy the fix, restrict exposure of the scheduler port: bind the service to loopback or a private interface and use host firewall rules to block the sched_port from all untrusted networks (side effect: breaks multi-host scheduler setups that rely on cross-node connectivity, so scope firewall rules to trusted worker hosts only). Where balance_serve mode is not needed, disable it to remove the vulnerable RPC server entirely. See the VulnCheck advisory (https://www.vulncheck.com/advisories/ktransformers-unsafe-deserialization-rce-via-balance-serve) and the exploit write-up (https://chocapikk.com/posts/2026/ktransformers-pickle-rce/) for detection context.
More in Ktransformers
View allSame weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today