Database/AI/ML frameworks & serving
PyTorch (`torch.distributed` RemoteModule / RPC): Deserialization RCE across the distributed RPC channel
Impact
Deserialization RCE across the distributed RPC channel (vendor-disputed as intended behavior)
Who can reach it
Any host that can reach the RPC port of a multi-node training job — i.e. a co-tenant on the same fabric
What to do
No patch — vendor position is that torch.distributed is a trusted-network protocol. Remediation is network isolation: per-tenant VRF/VLAN on the training fabric, never expose RPC ports across tenants
Fleet impact
How widespread
Very common - torch.distributed RPC / RemoteModule underpins multi-node training and RL rollout fanout on GPU clusters
Cost to remediate
Config/network change, not a patch - PyTorch disputes it, so remediation is isolating the RPC plane per tenant, which is an architectural change across the fleet
Why it hits the whole fleet
RemoteModule deserializes attacker-controlled data, so anyone who can reach a training job's RPC port executes code on every rank - one reachable worker owns the whole distributed job
References
Related entries
- PyTorch Lightning: RCE via deserialization of untrusted checkpointCVE-2024-5452 · PyTorch LightningCritical
- vLLM (`AsyncEngineRPCServer`): Unsafe deserialization on RPC entrypointsCVE-2024-9053 · vLLM (`AsyncEngineRPCServer`)Critical
- BentoML (runner server): Deserialization RCE on the internal runner serverCVE-2024-9070 · BentoML (runner server)Critical
- MLflow (auth): Weak password requirementsCVE-2025-11200 · MLflow (auth)Critical
- MLflow (model creation): Directory traversal on model creationCVE-2025-11201 · MLflow (model creation)Critical
- MLflow (serving container init): Command injection in `_install_model_dependencies`CVE-2025-15379 · MLflow (serving container init)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.