Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.
| CVE | CVE-2026-49950 |
|---|---|
| Severidad | CRITICAL |
| CVSS | 9.8 / 10 |
| CWE | CWE-502 |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
Producto afectado
Xorbits Xoscar 0.11.2
Producto derivado de la descripción (el CPE estructurado de NVD aún no está publicado).
Técnica MITRE ATT&CK
T1190 – Exploit Public-Facing Application
Mapeo automático best-effort por clase de vulnerabilidad (CWE) -- orientación, no certificación.