ktransformers CVE-2026-63767

Exploitation requires network reachability to the SchedulerServer ZMQ ROUTER socket, which in vulnerable versions is bound to all interfaces (tcp://*:{sched_port}, i.e. 0.0.0.0) - so any host that can route to the scheduler port of a default-configured ktransformers balance_serve deployment can exploit it with no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N). The concrete prerequisite is that the balance_serve scheduler RPC service is running and its sched_port is reachable from the attacker. Limiting factors: the deployment must actually run the balance_serve scheduler component, and exploitation is prevented if the port is firewalled or the service is otherwise not reachable from the attacker's network position; there is no version/platform-specific constraint beyond ktransformers <= 0.6.3.

All signals point to a genuine high-priority issue rather than an inflated CVSS. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) indicates network-reachable, low-complexity, no-privilege, no-interaction exploitation with full confidentiality, integrity and availability impact - consistent with unauthenticated RCE. Public exploit code exists (referenced in the GitHub issue) and the root cause is a well-understood, highly reliable bug class (pickle __reduce__), which makes exploitation deterministic and automatable rather than probabilistic. No EPSS score and no CISA KEV entry were provided, so real-world exploitation frequency is unknown; the absence of KEV means active exploitation is not confirmed, and the mitigating real-world factor is that the scheduler port must be network-reachable (in some deployments it may sit behind a firewall or on a trusted subnet). No conflicting signals were found: the CVSS network vector is corroborated by the code evidence showing an all-interfaces bind.

An attacker who can reach the ktransformers scheduler port (bound to 0.0.0.0) connects to the ZMQ ROUTER socket and sends a crafted pickle payload whose __reduce__ method invokes os.system or subprocess to run attacker-chosen commands. Because no authentication or user interaction is required and the attack complexity is low, the payload executes as the server process the moment it is deserialized. Public exploit code for this bug is already available, lowering the skill barrier to opportunistic attackers.