Database/AI/ML frameworks & serving
Mercury: tokenless deployments let anonymous clients start kernels and execute arbitrary Python
Impact
In default tokenless Mercury deployments before 3.2.6 the endpoint blocklist does not cover /api/kernels, and the websocket wrapper tracked idle activity without authorizing executable messages. An anonymous client can therefore create a Jupyter kernel and send execute_request messages containing arbitrary Python. That is remote code execution as the Mercury service account on whatever node hosts it, and because Mercury is used to publish notebooks to colleagues it is frequently reachable from a wider internal network than the notebooks themselves. On a GPU node the kernel it spawns inherits the pod's device access, so the attacker gets the accelerators, the mounted datasets and any credentials in the environment.
Who can reach it
Any client that can reach the Mercury HTTP/websocket port. No authentication is needed in the default tokenless configuration.
What to do
Upgrade to Mercury 3.2.6 and restart the service; the fix is in commit 73a40ce. Deployments that cannot upgrade immediately should be put behind an authenticating proxy and taken off any broadly reachable interface, and any node that ran an exposed instance should be checked for kernels and processes started by the service account.
References
Related entries
- Keras (Lambda layer): Arbitrary code execution via Lambda-layer deserialization in 3.14.0CVE-2026-12481 · Keras (Lambda layer)Critical
- SGLang (`/load_lora_adapter_from_tensors`): Unauthenticated RCE bypassing `SafeUnpickler`'s incomplete denylistCVE-2026-15969 · SGLang (`/load_lora_adapter_from_tensors`)Critical
- vLLM (image error echo): Error path returns sensitive content on invalid image inputCVE-2026-22778 · vLLM (image error echo)Critical
- Milvus (port 9091): Management port 9091 exposed by default enabling compromiseCVE-2026-26190 · Milvus (port 9091)Critical
- SGLang (multimodal ZMQ broker): Unauthenticated RCE via `pickle.loads()` on the ZMQ brokerCVE-2026-3059 · SGLang (multimodal ZMQ broker)Critical
- SGLang (encoder parallel disaggregation): Unauthenticated RCE via `pickle.loads()` in the disaggregation moduleCVE-2026-3060 · SGLang (encoder parallel disaggregation)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.