CVE-2026-26210
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
KTransformers through version 0.5.3 has an unsafe deserialization vulnerability in the balance_serve backend mode. The scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. Attackers can send a crafted pickle payload to the exposed ZMQ socket to execute arbitrary code on the server with the privileges of the ktransformers process.
Risk Assessment
The organization is at risk of remote code execution by an unauthenticated attacker, potentially leading to data theft, malware installation, or complete system compromise.
Recommendation
Immediately update KTransformers to a version newer than 0.5.3 if available, or temporarily disable the balance_serve mode and restrict access to the ZMQ socket using a firewall.
Original NVD description (English source)
KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. Attackers can send a crafted pickle payload to the exposed ZMQ socket to execute arbitrary code on the server with the privileges of the ktransformers process.