# CVE-2026-63767: kvcache-ai ktransformers pickle deserialization in SchedulerServer

Source: https://junglewise.ai/threats/cve-2026-63767-kvcache-ai-ktransformers-pickle-deserialization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-63767 · Severity: critical · CVSS 9.8 · Published 2026-07-20

ktransformers is a high-performance framework for running large language models. A security flaw in its internal communication system allows an attacker to remotely execute commands on the server without any password or authentication. This could lead to a complete takeover of the system hosting the AI models, potentially exposing sensitive data or disrupting operations.

Vendors: [Kvcache-Ai](https://junglewise.ai/threats/vendors/kvcache-ai).

## Quick answers

**Is CVE-2026-63767 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63767 being exploited in the wild.

**How severe is CVE-2026-63767?** Critical severity, with a CVSS score of 9.8, published 20 July 2026.

**Which products and versions are affected?** Kvcache-Ai Ktransformers <= 0.6.3.

**Is there a fix for CVE-2026-63767?** A patch was published on 2026-07-19: Fix merged in commit def0f93 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63767 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63767?** Check whether you run Kvcache-Ai Ktransformers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

ktransformers (up to version 0.6.3) is vulnerable to unauthenticated remote code execution due to insecure use of the Python 'pickle' library. The SchedulerServer component, used in the balance_serve backend, binds a ZeroMQ ROUTER socket to all network interfaces (0.0.0.0) by default. This socket lacks authentication and passes all incoming messages directly to pickle.loads(). An attacker can send a crafted pickle payload containing a malicious __reduce__ method to execute arbitrary shell commands with the privileges of the server process. The vulnerability was addressed in commit def0f93 by binding the ZMQ socket to the loopback interface (127.0.0.1) instead of all interfaces.

## Affected products

- kvcache-ai ktransformers <= 0.6.3

## Timeline

- 2026-06-12: other: Vulnerability reported to vendor
- 2026-07-13: disclosed: Public issue opened on GitHub
- 2026-07-19: patched: Fix merged in commit def0f93
- 2026-07-20: advisory: CVE published and NVD record created

## References

- [https://github.com/kvcache-ai/ktransformers/commit/def0f9313d6e063b5c5ccdfa1f6707f7a40dfdca](https://github.com/kvcache-ai/ktransformers/commit/def0f9313d6e063b5c5ccdfa1f6707f7a40dfdca)
- [https://github.com/kvcache-ai/ktransformers/issues/2087](https://github.com/kvcache-ai/ktransformers/issues/2087)
- [https://github.com/kvcache-ai/ktransformers/pull/2091](https://github.com/kvcache-ai/ktransformers/pull/2091)
- [https://www.vulncheck.com/advisories/ktransformers-unauthenticated-pickle-deserialization-rce-via-zmq](https://www.vulncheck.com/advisories/ktransformers-unauthenticated-pickle-deserialization-rce-via-zmq)

## Related threats

- [KTransformers unsafe deserialization in balance_serve ZMQ scheduler](https://junglewise.ai/threats/cve-2026-26210-ktransformers-unsafe-deserialization-in-balance-serve-zmq)