Executive brief
ktransformers is a high-performance framework for running large language models. A security flaw in its internal communication system allows an attacker to remotely execute commands on the server without any password or authentication. This could lead to a complete takeover of the system hosting the AI models, potentially exposing sensitive data or disrupting operations.
Technical details
ktransformers (up to version 0.6.3) is vulnerable to unauthenticated remote code execution due to insecure use of the Python 'pickle' library. The SchedulerServer component, used in the balance_serve backend, binds a ZeroMQ ROUTER socket to all network interfaces (0.0.0.0) by default. This socket lacks authentication and passes all incoming messages directly to pickle.loads(). An attacker can send a crafted pickle payload containing a malicious __reduce__ method to execute arbitrary shell commands with the privileges of the server process. The vulnerability was addressed in commit def0f93 by binding the ZMQ socket to the loopback interface (127.0.0.1) instead of all interfaces.
Affected products
- kvcache-ai ktransformers <= 0.6.3
Timeline
- 2026-06-12: other: Vulnerability reported to vendor
- 2026-07-13: disclosed: Public issue opened on GitHub
- 2026-07-19: patched: Fix merged in commit def0f93
- 2026-07-20: advisory: CVE published and NVD record created
References
- https://github.com/kvcache-ai/ktransformers/commit/def0f9313d6e063b5c5ccdfa1f6707f7a40dfdca
- https://github.com/kvcache-ai/ktransformers/issues/2087
- https://github.com/kvcache-ai/ktransformers/pull/2091
- https://www.vulncheck.com/advisories/ktransformers-unauthenticated-pickle-deserialization-rce-via-zmq