Executive brief
OmniGen2-RL, an open-source AI model component used for reinforcement learning, contains a critical security flaw in its reward server. This component is responsible for scoring AI outputs during training. An attacker can exploit this flaw to remotely take control of the server, potentially leading to the theft of sensitive AI models, unauthorized use of expensive GPU computing resources, or complete system compromise.
Technical details
The vulnerability exists in the reward server and proxy components of OmniGen2-RL due to the use of the insecure 'pickle' library for deserializing incoming network data. Specifically, the 'reward_proxy.py' and 'reward_server.py' scripts call pickle.loads() directly on the body of unauthenticated HTTP POST requests. Because the Python pickle module can execute arbitrary code during the deserialization process via the __reduce__ protocol, a remote attacker can achieve full code execution on the host system. The service binds to all network interfaces (0.0.0.0) by default, and no authentication or encryption is implemented, making it accessible to any network-adjacent attacker. A pull request (#139) has been submitted to replace pickle with JSON and add authentication, but users should ensure they apply these fixes or restrict network access to these ports.
Affected products
- Beijing Academy of Artificial Intelligence (BAAI) / VectorSpaceLab OmniGen2-RL All versions prior to March 2026
Timeline
- 2026-02-10: disclosed: Vulnerability discovered and reported to vendor
- 2026-03-18: advisory: Public disclosure and CVE assignment
- 2026-03-18: other: Fix PR submitted by researcher
References
- https://arxiv.org/abs/2506.18871
- https://chocapikk.com/posts/2026/omnigen2-pickle-rce/
- https://github.com/VectorSpaceLab/OmniGen2/blob/3a13017e532f9f309a38bca571fd62200a6415c5/OmniGen2-RL/reward_server/reward_proxy.py
- https://github.com/VectorSpaceLab/OmniGen2/blob/3a13017e532f9f309a38bca571fd62200a6415c5/OmniGen2-RL/reward_server/reward_proxy.py
- https://github.com/VectorSpaceLab/OmniGen2/blob/3a13017e532f9f309a38bca571fd62200a6415c5/OmniGen2-RL/reward_server/reward_server.py
- https://github.com/VectorSpaceLab/OmniGen2/pull/139
- https://www.vulncheck.com/advisories/omnigen2-rl-reward-server-unsafe-deserialization-rce