CVE-2026-49950 in Xoscar
Summary
by MITRE • 10/14/2026
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Xorbits Xoscar versions through 0.11.2 represents a critical security flaw rooted in improper handling of serialized data within its distributed computing architecture. This unauthenticated deserialization issue allows remote attackers to achieve arbitrary code execution by exploiting the actor-pool TCP channel, which serves as the primary communication backbone for coordinating tasks across cluster nodes. The core technical failure lies in the sequence of operations performed when receiving network traffic via SocketChannel.recv(). Instead of validating the message type or structure before processing the payload, the system immediately passes unvalidated data directly to cloudpickle.loads() for deserialization. This inversion of validation logic creates a window where maliciously crafted pickle streams can be processed without any authentication checks, effectively bypassing security controls that should restrict access to privileged operations.
The exploitation mechanism relies on the specific behavior of Python's pickle module and its extension library, cloudpickle. When an attacker sends a specially constructed payload over the TCP channel, the deserialization process triggers _reduce_ gadgets embedded within the serialized objects. These gadgets are designed to execute arbitrary commands during the unpickling phase, often before any subsequent message type validation can occur. Because this execution happens at the point of data ingestion, it allows for remote code execution with the privileges of the Xoscar server process. In typical deployment scenarios involving GPU nodes or high-performance computing environments, these services frequently run as root to ensure access to hardware resources and network interfaces. Consequently, successful exploitation grants attackers full control over the underlying operating system, enabling them to install backdoors, exfiltrate sensitive data, pivot to other systems within the cluster, or disrupt critical computational workloads.
From a classification perspective, this vulnerability aligns with CWE-502, which denotes Deserialization of Untrusted Data. The lack of input validation prior to deserialization is the primary indicator of this weakness. Furthermore, in terms of offensive security frameworks such as MITRE ATT&CK, this exploit maps directly to T1059 Command and Scripting Interpreter, specifically through Python execution capabilities enabled by pickle gadgets. It also relates to T1190 Exploit Public-Facing Application if the Xoscar service is exposed to untrusted networks without adequate network segmentation or access controls. The severity of this issue is compounded by its remote nature and the high privilege level typically associated with data processing services, making it a significant risk for organizations relying on distributed computing frameworks like Xorbits.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade Xoscar to version 0.12 or later where this vulnerability has been patched by enforcing strict message type validation before deserialization occurs. For environments that cannot immediately patch, network-level controls should be implemented to restrict access to the actor-pool TCP ports exclusively to trusted IP addresses within the cluster subnet. Additionally, running Xoscar services with minimal privileges rather than as root can significantly reduce the impact of a successful exploitation attempt by limiting the attacker's ability to modify system configurations or install persistent malware. Organizations should also implement strict input validation and consider disabling pickle deserialization for untrusted sources entirely, opting instead for safer serialization formats like JSON if applicable to their use cases. Regular security audits and penetration testing focused on distributed computing components are recommended to identify similar flaws in related infrastructure.