ByteDance verl CVE-2026-6878

No vendor-released patch has been identified at time of analysis due to the vendor's non-response to disclosure. Users should immediately upgrade to a version newer than 0.7.0 if one becomes available; however, the absence of vendor communication means current deployments cannot rely on an official security release. As compensating controls, restrict network access to verl evaluation endpoints using firewall rules or API gateway authentication to limit remote attack surface, isolate verl services into separate network segments to contain potential information leakage, and disable or restrict access to the math_equal function in prime_math/grader.py if not critical to your use case (document functional impact before disabling). Monitor for unusual access patterns to grader.py or unexpected outputs from mathematical evaluation functions. Consider forking verl and applying a patch that adds input validation to the math_equal function, or switch to alternative machine learning training frameworks with more active security governance if this vulnerability blocks your deployment timeline.