KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. Attackers can send a crafted pickle payload to the exposed ZMQ socket to execute arbitrary code on the server with the privileges of the ktransformers process.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://chocapikk.com/posts/2026/ktransformers-pickle-rce/ Exploit, Mitigation, Third Party Advisory
- https://github.com/kvcache-ai/ktransformers/pull/1944 Issue Tracking, Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.3 · kvcache-aiNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:kvcache-ai:ktransformers:*:*:*:*:*:*:*:*
References 3
- https://chocapikk.com/posts/2026/ktransformers-pickle-rce/ Exploit, Mitigation, Third Party Advisory
- https://github.com/kvcache-ai/ktransformers/pull/1944 Issue Tracking, Patch
- https://www.vulncheck.com/advisories/ktransformers-unsafe-deserialization-rce-via-balance-serve Third Party Advisory