CVE-2026-26210
Critical · CVSS 9.8KTransformers — Unsafe deserialization (pickle) RCE via unauthenticated ZMQ ROUTER socket
- CVSS
- 9.8
- nvd
- EPSS
- 0.70%
- 49th pct
- KEV
- No
- Class
- oss containerizable
- CWE-502
Description
KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. Attackers can send a crafted pickle payload to the exposed ZMQ socket to execute arbitrary code on the server with the privileges of the ktransformers process.
Search profile — drives PoC discovery
Symbols pickle.loadsbalance_serveZMQ ROUTERscheduler RPC serverzmq.ROUTERktransformersbalance_serve backend
Keywords CVE-2026-26210KTransformers pickle RCEKTransformers unsafe deserializationKTransformers balance_serveKTransformers ZMQ ROUTERktransformers scheduler RPC picklektransformers 0.5.3 RCECWE-502 KTransformers
Versions: <=0.5.3
References
Status: enriched · ingested 2026-07-14T18:00:20.000Z · profiled 2026-07-14T18:30:20.000Z