CVE-2026-26210

KTransformers (versions up to 0.5.3) contains an unsafe deserialization vulnerability in the balance_serve backend. The scheduler RPC server binds a ZMQ ROUTER socket to all interfaces without authentication and deserializes incoming messages with pickle.loads() without validation, enabling an at...