ktransformers SchedulerServer Unauthenticated Pickle Deserialization RCE

Technical Analysis

The vulnerability (CVE-2026-63767, CVSS 9.8) stems from insecure deserialization of pickle objects received over a ZMQ ROUTER socket in ktransformers' SchedulerServer component. Because the socket binds to 0.0.0.0 by default and performs no authentication, any network-reachable attacker can submit a crafted pickle payload embedding a malicious __reduce__ method, triggering arbitrary shell command execution during deserialization. This is a classic Python pickle RCE pattern (similar to CVE-2019-8341, CVE-2022-1941, and numerous ML framework issues) applied to an LLM serving/scheduling pipeline. The fix is included in commit def0f93; unpatched deployments remain fully exploitable pre-authentication. Given ktransformers is widely used to accelerate large model inference (including MoE/DeepSeek-style models) in self-hosted and agentic AI stacks, this vulnerability directly threatens AI agent infrastructure by allowing attackers to pivot from a compromised inference server into full host takeover, exfiltrate model weights, API keys, and RAG data, or hijack the agent's tool-execution environment.

Affected Systems

ktransformers versions through 0.6.3 (all versions prior to commit def0f93); specifically hosts running the SchedulerServer component with its ZMQ ROUTER socket exposed on network-accessible interfaces (default binds to all interfaces).

Indicators of Compromise

• N/A - vulnerability disclosure; no confirmed public exploitation IOCs at time of analysis. Monitor for: unexpected ZMQ traffic on SchedulerServer port, anomalous child processes spawned by ktransformers server process, unusual outbound connections from inference hosts, unauthorized pickle payload patterns in network capture.

Remediation Steps

1. 1

   Upgrade ktransformers

   Update to the patched version incorporating commit def0f93 or later immediately.

2. 2

   Restrict network exposure

   Bind the SchedulerServer ZMQ socket to localhost or an internal-only interface, and enforce firewall/network segmentation to block external access to the ROUTER socket port.

3. 3

   Implement authentication

   Deploy ZMQ CURVE authentication/encryption or place the service behind a mutually-authenticated proxy/VPN until upstream authentication support matures.

4. 4

   Avoid pickle for untrusted input

   Where feasible, replace pickle-based serialization with safer formats (e.g., JSON, protobuf, msgpack) for any inter-process or network communication.

5. 5

   Monitor and isolate

   Run inference/scheduler processes with least-privilege service accounts, in isolated containers/sandboxes, and monitor for unexpected process spawning or command execution.

6. 6

   Audit agent deployments

   Inventory all AI agent and LLM pipelines using ktransformers to identify exposed instances, especially those with access to API keys, secrets, or RAG data stores.