CVE-2026-49950

Received Received - Intake

Unauthenticated Deserialization RCE in Xorbits Xoscar

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-49950

EUVD

EUVD-2026-100500

Affected Vendors & Products

Vendor	Product	Version / Range
xorbitsai	xoscar	0.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

Xorbits Xoscar through 0.11.2 has an unauthenticated deserialization vulnerability. Remote attackers can execute arbitrary code by sending crafted data over the actor-pool TCP channel. The vulnerability occurs because SocketChannel.recv() passes unvalidated data to cloudpickle.loads(), which executes pickle __reduce__ gadgets before message type validation. This leads to remote code execution as the server process, often running as root on GPU nodes.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code on affected systems. Since the server process often runs as root on GPU nodes, attackers could gain full control over the system, steal sensitive data, install malware, or disrupt operations. Unpatched systems are at high risk of compromise.

Compliance Impact

This vulnerability can lead to severe compliance violations under GDPR and HIPAA due to unauthorized data access or exfiltration. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A successful exploit could result in data breaches, triggering regulatory fines, legal penalties, and reputational damage for organizations.

Mitigation Strategies

Immediately upgrade Xorbits Xoscar to version 0.11.3 or later to address the deserialization flaw. Block or restrict access to the actor-pool TCP channel on all systems running Xoscar, especially GPU nodes. Monitor network traffic for unusual activity targeting this channel.

Hi! I’m here to help you understand CVE-2026-49950. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70