KTransformers: unauthenticated ZMQ scheduler socket unpickles input, giving remote RCE

Impact

In balance_serve mode the scheduler RPC server binds a ZMQ ROUTER socket on all interfaces with no authentication and feeds whatever arrives to pickle.loads(). Anyone who can reach that port runs code as the ktransformers process - which on an inference host is a process holding the GPUs, the model weights and whatever credentials the serving pod carries. There is no exploit prerequisite beyond network reach: no token, no valid request shape. Because the socket binds to 0.0.0.0, an instance started for a single-tenant benchmark is exposed to the whole cluster network unless something else blocks the port.

Who can reach it

Anyone with network reach to the balance_serve scheduler port on the serving host - any tenant pod on the same network, or the internet if the node is externally addressable. No authentication.

What to do

Update past 0.5.3 with the linked upstream pull request and restart the serving process. Short of that, bind the scheduler socket to localhost or firewall the port so only the serving node itself can reach it, and treat any exposed instance as compromised: rotate credentials available to the process. Patch and restart only - no node reboot.

References

Related entries

• Jupyter Server: notebook HTML rendered without CSP sandbox gives stored XSS and kernel RCECVE-2026-44727 · Jupyter Server nbconvert HTTP handlers (Content-Security-Policy sandbox directive)Critical
• OpenMed: unauthenticated model_name routes to a trust_remote_code loader and executes attacker codeCVE-2026-47117 · OpenMed privacy-filter model loader (model_name dispatcher, trust_remote_code=True path)Critical
• jupyterlab-git: crafted filename in a rename diff executes JavaScript in the notebook user's browserCVE-2026-54527 · jupyterlab-git (PlainTextDiff.ts rename-diff rendering)Critical
• LLaMA-Factory: model path in the WebUI loads remote code and executes it as the training server processCVE-2026-58116 · LLaMA-Factory WebUI (model path -> from_pretrained with trust_remote_code=True)Critical
• ktransformers: unauthenticated pickle deserialization on the scheduler ZMQ socket gives RCE as the server processCVE-2026-63767 · ktransformers SchedulerServer (ZMQ ROUTER socket)Critical
• MLflow: unauthenticated webhook test follows redirects, turning the tracking server into an SSRF proxyCVE-2026-64849 · MLflow tracking server (webhook test endpoint, /api/2.0/mlflow/webhooks/{id}/test)Critical