CVE-2026-49950

Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool

State: Published
Severity: 9.3 Critical
Published: Oct 13, 2026
Updated: Oct 16, 2026
Reserved: Jun 2, 2026

Description

Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
xoscarxorbitsai	0.1.0 through 0.11.2Affected

References

Vulnerable Sink
Unauthenticated Entry Point
VulnCheck Advisory: Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Poolthird-party-advisory
VulnCheck Blog: Xorbits Xoscar: Unauthenticated RCE via Cloudpickle Deserialization in the Actor Poolexploittechnical-description

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.