Executive brief
Angel is a distributed parameter server framework used for large-scale machine learning training. A vulnerability in its RPC endpoint allows unauthenticated attackers to deserialize malicious serialized objects, enabling them to execute arbitrary code or crash the coordinator by consuming all available memory.
Technical details
The vulnerability is an unsafe deserialization flaw in the setAlgoMetrics payload handler. Angel uses Kryo serialization without class registration or allowlisting when deserializing metric objects from the master RPC endpoint. An unauthenticated network attacker can send crafted serialized payloads to instantiate arbitrary classes or trigger gadget chains. The vulnerable code path is in KryoUtils.deserializeAlgoMetric(), which uses KryoReflectionFactorySupport to deserialize untrusted data without validation. Exploitation requires network access to the coordinator's RPC endpoint but does not require prior authentication. Patches should implement strict class allowlisting or replace Kryo with safer serialization mechanisms.
Affected products
- Angel-ML Angel through 3.3.0
Timeline
- 2026-09-16: disclosed