CVE-2026-49950

Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv passing unvalidated data to cloudpickle.loads, which...

CVE-2026-49950 Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool

Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv passing unvalidated data to cloudpickle.loads, which...

CVE-2026-49950

Xorbits Xoscar versions through 0.11.2 are vulnerable to an unauthenticated deserialization flaw. The root cause is the insecure use of cloudpickle.loads() on unvalidated data received via SocketChannel.recv() over the actor-pool TCP channel . This allows a remote attacker to trigger pickle ——red...

PT-2026-113373

Name of the Vulnerable Software and Affected Versions Xorbits Xoscar versions prior to 0.11.2 Description An unauthenticated deserialization flaw exists in the actor-pool TCP channels. Remote attackers can execute arbitrary code with root privileges on GPU nodes by sending crafted data. The issue...