EUVD-2026-46075
GHSA-6vqg-j4cx-cqv4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable pickle deserialization on an all-interfaces socket gives low-complexity RCE (PR:N, AC:L) with full C/I/A impact and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can exploit malicious __reduce__ methods embedded in crafted pickle payloads to execute arbitrary shell commands as the server process.
AnalysisAI
Remote code execution in ktransformers (kvcache-ai) through version 0.6.3 allows unauthenticated attackers to run arbitrary shell commands by sending crafted pickle payloads to the SchedulerServer's ZMQ ROUTER socket, which is bound to all network interfaces (0.0.0.0). The flaw stems from unsafe pickle deserialization of RPC messages, letting an attacker weaponize a malicious __reduce__ method to execute code as the server process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the SchedulerServer ZMQ ROUTER socket, which in vulnerable versions is bound to all interfaces (tcp://*:{sched_port}, i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a genuine high-priority issue rather than an inflated CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the ktransformers scheduler port (bound to 0.0.0.0) connects to the ZMQ ROUTER socket and sends a crafted pickle payload whose __reduce__ method invokes os.system or subprocess to run attacker-chosen commands. Because no authentication or user interaction is required and the attack complexity is low, the payload executes as the server process the moment it is deserialized. … |
| Remediation | Upgrade to a build that includes the vendor fix in commit def0f9313d6e063b5c5ccdfa1f6707f7a40dfdca (PR #2091), which changes the scheduler bind from `tcp://*:{sched_port}` (all interfaces) to `tcp://127.0.0.1:{sched_port}` (loopback only); a released patched version was not independently confirmed, so track the vendor's next tagged release or pin to the fixed commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all ktransformers deployments to identify systems with ZMQ ROUTER sockets exposed to untrusted networks (typically port 5555), and immediately restrict access to authorized internal hosts only; isolate any internet-facing instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ktransformers
View allSame weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today