EUVD-2026-25305
GHSA-w598-p4vc-7qcx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan network for exposed scheduler port
-
DeliveryCraft malicious pickle payload
-
ExploitSend to unauthenticated ZMQ ROUTER socket
-
Executionpickle.loads deserializes payload
-
PersistExecute arbitrary code as ktransformers process
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to be running KTransformers (≤0.5.3) in balance_serve backend mode, which starts the scheduler RPC server; that server binds its ZMQ ROUTER socket to all interfaces (tcp://*:{sched_port}) with no authentication, so the attacker only needs network reachability to the scheduler port. No credentials, user interaction, or non-default socket options are needed once balance_serve is active (matches AV:N/AC:L/PR:N/UI:N). The primary limiting factors are deployment-specific: the vulnerable path exists only in balance_serve mode (not the default/other backends) and only when the scheduler port is exposed beyond loopback - installs not using balance_serve, or with the port firewalled to localhost, are not remotely exploitable. |
| Impact | The signals are strongly aligned on high technical severity but mixed on real-world urgency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, base 9.3) and SSVC (Technical Impact: total, Automatable: yes) both indicate a trivially exploitable, fully-impactful RCE, and public exploit code plus source-level confirmation from the patch diff remove any doubt about feasibility. Against this, EPSS is very low (0.04%, 11th percentile) and the CVE is not listed in CISA KEV, indicating no confirmed active exploitation and a limited install base rather than mass scanning. The key mitigating nuance not captured by the raw CVSS: exploitation requires the balance_serve backend mode to be running and its scheduler port to be network-reachable - a specific, non-default deployment rather than every KTransformers install. Net: this is a genuine critical-severity RCE that should be patched promptly wherever balance_serve is exposed, but the low EPSS and niche footprint suggest targeted rather than widespread exploitation risk. |
| Exploit ScenarioDerived | An attacker scans for exposed KTransformers scheduler ports and finds a balance_serve deployment with its ZMQ ROUTER socket reachable on the network. They send a single crafted pickle payload whose __reduce__ method spawns a reverse shell; the server deserializes it with pickle.loads() and executes the code as the ktransformers process, yielding full RCE with no authentication or user interaction. Public exploit code (chocapikk / VulnCheck) demonstrates the technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Remote code execution in KTransformers through 0.5.3 lets unauthenticated network attackers run arbitrary code by sending a crafted pickle payload to the scheduler RPC service used in balance_serve backend mode. The affected code binds a ZMQ ROUTER socket to all interfaces (0.0.0.0) with no authentication and passes received frames straight into pickle.loads(), so any host that can reach the scheduler port gains code execution as the ktransformers process. Publicly available exploit code exists (VulnCheck/chocapikk write-up) and a vendor upstream fix is available, though the EPSS probability is currently low at 0.04%.
RemediationAI
Apply the upstream fix from GitHub PR https://github.com/kvcache-ai/ktransformers/pull/1944, which binds the scheduler socket to 127.0.0.1 by default, adds HMAC-SHA256 authentication of RPC frames, and replaces pickle.loads with a restricted unpickler - a released patched version number is not independently confirmed from the input, so upgrade to the first tagged release incorporating PR #1944 and set KTRANSFORMERS_RPC_SECRET as the patch requires. Until you can deploy the fix, restrict exposure of the scheduler port: bind the service to loopback or a private interface and use host firewall rules to block the sched_port from all untrusted networks (side effect: breaks multi-host scheduler setups that rely on cross-node connectivity, so scope firewall rules to trusted worker hosts only). Where balance_serve mode is not needed, disable it to remove the vulnerable RPC server entirely. See the VulnCheck advisory (https://www.vulncheck.com/advisories/ktransformers-unsafe-deserialization-rce-via-balance-serve) and the exploit write-up (https://chocapikk.com/posts/2026/ktransformers-pickle-rce/) for detection context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
KTransformers is a heterogeneous CPU/GPU LLM inference framework from kvcache-ai. In balance_serve mode it runs an internal scheduler as a separate process that communicates over a ZeroMQ (ZMQ) ROUTER/DEALER RPC channel (sched_rpc.py). The vulnerability is a classic CWE-502 Deserialization of Untrusted Data: the server called pickle.loads() on raw ZMQ frames, and Python's pickle can invoke arbitrary callables (via __reduce__) during deserialization, turning any attacker-controlled byte stream into code execution. Two design faults compounded the risk - the socket bound to tcp://*:{sched_port} (all interfaces rather than loopback) and there was no message authentication. The PR #1944 fix addresses all three: it binds to 127.0.0.1 by default, adds HMAC-SHA256 signing/verification of frames with a shared secret, and replaces pickle.loads with a RestrictedUnpickler allowlisting only safe types plus the C++ scheduler extension objects, while moving KV-cache tensor transport to safetensors. The single affected CPE is cpe:2.3:a:kvcache-ai:ktransformers.
Know when Ktransformers gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network RCE via an exposed no-auth ZMQ socket gives AV:N/AC:L/PR:N/UI:N; arbitrary code execution as the process yields full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. Attackers can send a crafted pickle payload to the exposed ZMQ socket to execute arbitrary code on the server with the privileges of the ktransformers process.
Executive ViewAI
KTransformers through version 0.5.3 contains an unauthenticated remote code execution vulnerability in its balance_serve backend that allows any network-capable attacker to execute arbitrary code and fully compromise affected systems. Organizations running this component expose their model serving infrastructure and any data processed through it to immediate takeover. Urgent remediation is required to prevent unauthorized access and potential data exfiltration.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB