Executive brief
Horovod is a distributed training framework used to speed up deep learning tasks across multiple computers. A security flaw in its coordination component allows an attacker to send malicious data that, when processed by the system, results in full remote control over the affected servers. This could lead to the theft of sensitive AI models, data breaches, or complete disruption of research and development operations.
Technical details
Horovod through version 0.28.1 is vulnerable to insecure deserialization (CWE-502) within its KVStore HTTP server component. The KVStore server, which facilitates distributed task coordination, lacks authentication and authorization, permitting unauthenticated remote attackers to submit arbitrary data via HTTP PUT requests. When a Horovod worker subsequently retrieves this data via HTTP GET, it processes the payload using cloudpickle.loads() without integrity verification. By injecting a malicious pickle payload, an attacker can achieve arbitrary code execution on the worker nodes. As of the advisory date, no patched versions have been identified.
Affected products
- horovod horovod <= 0.28.1
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory