CVE-2026-92785
Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes
- State
- Published
- Severity
- 9.2 Critical
- Published
- Sep 16, 2026
- Updated
- Sep 17, 2026
- Reserved
- Sep 16, 2026
Description
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-502 Deserialization of Untrusted Data
Affected Products
| Product | Versions |
|---|---|
angelAngel-ML |
|
References
- GitHub Issue #1355issue-tracking
- https://github.com/Angel-ML/angelproduct
- deserializeAlgoMetric reads an arbitrary class and casts only after constructiontechnical-description
- VulnCheck Advisory: Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.