Executive brief
KTransformers is an artificial intelligence framework used to run large language models efficiently on consumer hardware. A security flaw in its "balance_serve" mode allows unauthenticated attackers to remotely execute commands on the server hosting the model. This could lead to a total system takeover, theft of proprietary AI models, or unauthorized access to sensitive data processed by the AI.
Technical details
An unsafe deserialization vulnerability exists in KTransformers (up to version 0.5.3) within the 'balance_serve' backend mode. The scheduler RPC server (sched_rpc.py) initializes a ZeroMQ (ZMQ) ROUTER socket that binds to all network interfaces (0.0.0.0) without any authentication mechanism. Incoming messages are proxied to worker threads that process the raw bytes using the 'pickle.loads()' function without validation or a restricted unpickler. A remote, unauthenticated attacker can send a specially crafted Python pickle payload to the ZMQ port to achieve arbitrary code execution (RCE) with the privileges of the application process. While a patch has been proposed in Pull Request #1944, users are advised to avoid using the legacy 'balance_serve' mode or to restrict network access to the ZMQ ports.
Affected products
- KVCache.AI (kvcache-ai) KTransformers through 0.5.3
Timeline
- 2026-02-11: disclosed: Vulnerability discovered and confirmed by code audit
- 2026-04-23: advisory: CVE published and VulnCheck advisory released
- 2026-04-23: patched: Fix PR #1944 submitted to the repository