ktransformers: unauthenticated pickle deserialization on the scheduler ZMQ socket gives RCE as the server process

Impact

ktransformers is an LLM inference framework run on GPU nodes for local/offloaded serving. Its SchedulerServer binds a ZMQ ROUTER socket to all interfaces and unpickles whatever arrives, so anyone who can reach that port runs arbitrary commands as the serving process - no credentials needed. On a GPU node that process typically holds the model weights, the KV cache and a GPU context, so the attacker inherits read access to loaded models and tenant prompts and a foothold on a node that is expensive to drain. If the inference user can reach the container runtime socket or shared cluster storage, this is a pivot off the node rather than a single-process compromise.

Who can reach it

Anyone with network reach to the SchedulerServer ZMQ port, which is bound to all interfaces by default. No authentication is required. In practice this is any tenant pod on the same network or anyone on a flat cluster/management network; it is internet-reachable if the node is exposed.

What to do

Update past 0.6.3 to a build containing commit def0f93 (fixed via PR 2091) and restart the scheduler process - the serving daemon must be bounced, which drains in-flight requests. Until then, bind the scheduler socket to localhost or restrict the port with host/network policy so only the intended inference workers can reach it. The record names a fix commit, not a tagged release.

References

Related entries

• MLflow: unauthenticated webhook test follows redirects, turning the tracking server into an SSRF proxyCVE-2026-64849 · MLflow tracking server (webhook test endpoint, /api/2.0/mlflow/webhooks/{id}/test)Critical
• sentence-transformers: local model directory executes Python despite trust_remote_code=FalseCVE-2026-68770 · sentence-transformers (import_module_class trust_remote_code gate)Critical
• Langchain-Chatchat: unauthenticated /tools/call invokes the shell tool for remote command executionCVE-2026-75128 · Langchain-Chatchat (POST /tools/call API endpoint)Critical
• LMDeploy: unauthenticated p2p endpoints let a remote peer deliver a pickle payload for engine RCECVE-2026-76850 · LMDeploy (disaggregated serving ZMQ peer channel)Critical
• Headroom: client-supplied x-headroom-user-id header is trusted as identity, exposing other users' memoryCVE-2026-77776 · Headroom LLM proxy (x-headroom-user-id header treated as identity)Critical
• DB-GPT: shipped docker-compose sets a static MySQL root password and publishes 3306 on all interfacesCVE-2026-77933 · DB-GPT default docker-compose deployment (MySQL root credentials)Critical