Which versions of ktransformers are affected by EUVD-2026-46075?

ktransformers (kvcache-ai) versions through 0.6.3 contain a critical remote code execution vulnerability allowing unauthenticated network attackers to execute arbitrary system commands on affected…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-46075?

Yes, a public proof-of-concept exploit is available for EUVD-2026-46075. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate EUVD-2026-46075?

Within 24 hours, audit all ktransformers deployments to identify systems with ZMQ ROUTER sockets exposed to untrusted networks (typically port 5555), and immediately restrict access to authorized internal hosts only; isolate any internet-facing instances. Within 7 days, apply the available vendor patch from kvcache-ai to upgrade beyond version 0.6.3, verifying the patched version in a non-production environment first and consulting the official security advisory for the specific patched release number. Within 30 days, conduct forensic analysis of all affected systems for unauthorized access, command execution, or credential compromise; audit network connection logs for exploit attempts; and implement permanent network segmentation to ensure ktransformers services remain isolated from untrusted networks.

ktransformers EUVD-2026-46075

Q: What is the CVSS score of EUVD-2026-46075?

EUVD-2026-46075 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

| CVE-2026-63767 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-20 VulnCheck

GHSA-6vqg-j4cx-cqv4

Deserialization Ktransformers

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable pickle deserialization on an all-interfaces socket gives low-complexity RCE (PR:N, AC:L) with full C/I/A impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 20, 2026 - 20:15 vuln.today

Analysis Generated

Jul 20, 2026 - 20:15 vuln.today

CVE Published

Jul 20, 2026 - 19:13 cve.org

CRITICAL 9.3

DescriptionCVE.org

ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can exploit malicious __reduce__ methods embedded in crafted pickle payloads to execute arbitrary shell commands as the server process.

AnalysisAI

Remote code execution in ktransformers (kvcache-ai) through version 0.6.3 allows unauthenticated attackers to run arbitrary shell commands by sending crafted pickle payloads to the SchedulerServer's ZMQ ROUTER socket, which is bound to all network interfaces (0.0.0.0). The flaw stems from unsafe pickle deserialization of RPC messages, letting an attacker weaponize a malicious __reduce__ method to execute code as the server process. Publicly available exploit code exists and VulnCheck published an advisory; there is no public exploit identified in CISA KEV, so this is not yet confirmed as actively exploited.

Technical ContextAI

ktransformers is an open-source LLM inference/serving framework (kvcache-ai) that uses a balance-serve scheduler component. The SchedulerServer exposes an RPC interface over ZeroMQ (ZMQ) using a ROUTER socket, and the underlying RPC transport serializes messages with Python's pickle module. CWE-502 (Deserialization of Untrusted Data) is the root cause class: pickle is not a safe serialization format because unpickling can invoke arbitrary constructors and callables via the object's __reduce__ hook. Source evidence in sched_rpc.py shows the frontend socket was bound with tcp://*:{sched_port}, i.e. listening on every interface, so any host that can reach the scheduler port can submit crafted pickle data that is deserialized without authentication. The affected package is identified by CPE cpe:2.3:a:kvcache-ai:ktransformers.

RemediationAI

Upgrade to a build that includes the vendor fix in commit def0f9313d6e063b5c5ccdfa1f6707f7a40dfdca (PR #2091), which changes the scheduler bind from tcp://*:{sched_port} (all interfaces) to tcp://127.0.0.1:{sched_port} (loopback only); a released patched version was not independently confirmed, so track the vendor's next tagged release or pin to the fixed commit. As compensating controls where immediate upgrade is not possible: restrict network exposure of the scheduler ZMQ port by binding the service to localhost or a trusted management interface, and block the sched_port at the host/network firewall so only the local inference stack can reach it - trade-off is that legitimate remote/multi-host scheduler deployments will break and must be re-architected onto a trusted private network or authenticated tunnel (e.g. SSH/VPN or mTLS proxy). Do not expose ktransformers serving components directly to untrusted networks. Advisory URLs for tracking: https://github.com/kvcache-ai/ktransformers/pull/2091 and https://www.vulncheck.com/advisories/ktransformers-unauthenticated-pickle-deserialization-rce-via-zmq.