Database/AI/ML frameworks & serving
Fugue RPC server: unauthenticated cloudpickle deserialization gives code execution on cluster workers
Impact
Fugue's RPC server, used to call back into driver-side Python from distributed jobs on Spark, Dask or Ray, passes received data straight to cloudpickle.loads() with no validation or authentication. Anyone who can reach the RPC port executes arbitrary Python as the job's user on the machine hosting it. On a shared cluster that is a worker or driver process that may hold cluster credentials, dataset access and, on an accelerator node, the GPUs mapped into the job. The port is normally on the cluster network rather than the internet, which is why the record scores it adjacent-network rather than remote.
Who can reach it
Any host on the same network segment as a running Fugue job's RPC server. No authentication is required - the server deserializes whatever it is sent.
What to do
Upgrade past 0.9.2 to a release containing commit 6f25326 and restart any job or service that embeds the RPC server; jobs must be resubmitted to pick up the new version. Where an upgrade is not yet possible, restrict the RPC port to the job's own hosts at the network or security-group level.
References
Related entries
- OpenShift AI dashboard: incorrect network binding lets an in-cluster actor impersonate any user with an arbitrary tokenCVE-2026-16745 · Red Hat OpenShift AI odh-dashboard (network binding / token handling)High
- OpenShift AI training-operator: namespace edit/admin users escalate to host filesystem access via crafted training jobsCVE-2026-18982 · Red Hat OpenShift AI training-operator (ClusterRole aggregation + PodTemplateSpec passthrough)High
- vLLM (HF `auto_map`): Loads Hugging Face dynamic modules during model resolutionCVE-2026-22807 · vLLM (HF `auto_map`)High
- PyTorch (`weights_only` unpickler): Bypass of the `weights_only` allowlistCVE-2026-24747 · PyTorch (`weights_only` unpickler)High
- vLLM (hardcoded `trust_remote_code`, second instance): Same class, two more model files, through 0.18.0CVE-2026-27893 · vLLM (hardcoded `trust_remote_code`, second instance)High
- JupyterHub OAuthenticator: Authenticated user bypasses the intended identity checkCVE-2026-33175 · JupyterHub OAuthenticatorHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.