CVE-2026-63767: Transformers unauth pickle RCE

CISO Take

ktransformers, an inference framework used to run large language models efficiently on consumer hardware, ships a SchedulerServer component that binds a ZMQ ROUTER socket to all network interfaces without any authentication, and that socket deserializes incoming pickle payloads without validation — meaning anyone who can reach the port can embed a malicious __reduce__ method and get arbitrary shell commands executed as the server process. This is about as bad as it gets: CVSS 9.8, no privileges or user interaction required, network-exploitable, and the flaw is already documented publicly on GitHub with a technical write-up (issue #2087) tagged as an exploit, so weaponization is trivial even without EPSS telemetry yet. With 8,333 downstream dependents and 35 other CVEs already recorded against this package, any team running ktransformers-based inference — especially exposed beyond localhost — should treat this as an immediate compromise risk to the host and any data or credentials reachable from it. Patch to the version containing commit def0f93 immediately, or as a stopgap bind the SchedulerServer socket to localhost only and firewall off the ZMQ port until upgraded; hunt for unexpected child processes or outbound connections spawned by the ktransformers server process as a sign of prior exploitation.

Sources: NVD GitHub Advisory OpenSSF ATLAS

What is the risk?

Critical risk. The vulnerability combines the worst possible exploitability profile — network-reachable, no authentication, no privileges, no user interaction, low attack complexity — with full compromise impact (confidentiality, integrity, and availability all rated High). The root cause, CWE-502 unsafe pickle deserialization, is a well-understood and reliably exploitable class of bug with mature public tooling for payload generation. A working technical description and exploit discussion are already public on GitHub, and a third-party advisory (VulnCheck) exists, which materially raises the likelihood of opportunistic scanning even though it is not yet in CISA KEV and has no confirmed EPSS score. The absence of a Nuclei template or confirmed in-the-wild exploitation is the only mitigating factor, and that gap is likely to close quickly given how mechanical this exploit class is to automate.

How does the attack unfold?

Reconnaissance

Adversary scans network ranges for exposed ZMQ ROUTER sockets typical of ktransformers' SchedulerServer, which binds to all interfaces by default.

AML.T0006

Initial Access / Exploitation

Attacker sends a crafted pickle payload embedding a malicious __reduce__ method directly to the exposed, unauthenticated socket.

AML.T0049

Execution

The server deserializes the payload and executes the embedded arbitrary shell commands as the ktransformers server process.

AML.T0050

Impact

Attacker gains a foothold on the inference host, enabling data theft, model/credential exfiltration, or lateral movement into adjacent AI infrastructure.

AML.T0025

Reconnaissance

Adversary scans network ranges for exposed ZMQ ROUTER sockets typical of ktransformers' SchedulerServer, which binds to all interfaces by default.

AML.T0006

Initial Access / Exploitation

Attacker sends a crafted pickle payload embedding a malicious __reduce__ method directly to the exposed, unauthenticated socket.

AML.T0049

Execution

The server deserializes the payload and executes the embedded arbitrary shell commands as the ktransformers server process.

AML.T0050

Impact

Attacker gains a foothold on the inference host, enabling data theft, model/credential exfiltration, or lateral movement into adjacent AI infrastructure.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Transformers	pip	—	No patch
164.6K OpenSSF 6.4 9.3K dependents Pushed 5d ago 43% patched ~88d to patch Full package profile →

Do you use Transformers? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

1.1%

chance of exploitation in 30 days

Higher than 64% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade immediately to the version containing commit def0f9313d6e063b5c5ccdfa1f6707f7a40dfdca (merged via PR #2091), which removes or secures the unauthenticated pickle deserialization path. Until patched, do not expose the SchedulerServer ZMQ port to any untrusted network — bind it to localhost or a private management VLAN only, and enforce firewall/security-group rules restricting inbound access to that port to known trusted hosts. Where firewalling isn't immediately feasible, consider placing the scheduler behind a VPN or mutual-TLS proxy that ZMQ itself does not natively provide. For detection, monitor for unexpected child processes, shell spawns, or outbound network connections originating from the ktransformers server process, and review logs for unusual or malformed ZMQ traffic on the scheduler port. Inventory all internal hosts running ktransformers (via package/process scanning) since exposure is often unintentional in internal-only deployments that assumed network isolation was sufficient authentication.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Inference Framework AML.T0011.000 - Unsafe AI Artifacts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2 - AI system security controls / third-party and infrastructure dependencies

NIST AI RMF

MANAGE-4.1 - Post-deployment monitoring and incident response for AI risks

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-63767?

ktransformers, an inference framework used to run large language models efficiently on consumer hardware, ships a SchedulerServer component that binds a ZMQ ROUTER socket to all network interfaces without any authentication, and that socket deserializes incoming pickle payloads without validation — meaning anyone who can reach the port can embed a malicious __reduce__ method and get arbitrary shell commands executed as the server process. This is about as bad as it gets: CVSS 9.8, no privileges or user interaction required, network-exploitable, and the flaw is already documented publicly on GitHub with a technical write-up (issue #2087) tagged as an exploit, so weaponization is trivial even without EPSS telemetry yet. With 8,333 downstream dependents and 35 other CVEs already recorded against this package, any team running ktransformers-based inference — especially exposed beyond localhost — should treat this as an immediate compromise risk to the host and any data or credentials reachable from it. Patch to the version containing commit def0f93 immediately, or as a stopgap bind the SchedulerServer socket to localhost only and firewall off the ZMQ port until upgraded; hunt for unexpected child processes or outbound connections spawned by the ktransformers server process as a sign of prior exploitation.

Is CVE-2026-63767 actively exploited?

No confirmed active exploitation of CVE-2026-63767 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-63767?

Upgrade immediately to the version containing commit def0f9313d6e063b5c5ccdfa1f6707f7a40dfdca (merged via PR #2091), which removes or secures the unauthenticated pickle deserialization path. Until patched, do not expose the SchedulerServer ZMQ port to any untrusted network — bind it to localhost or a private management VLAN only, and enforce firewall/security-group rules restricting inbound access to that port to known trusted hosts. Where firewalling isn't immediately feasible, consider placing the scheduler behind a VPN or mutual-TLS proxy that ZMQ itself does not natively provide. For detection, monitor for unexpected child processes, shell spawns, or outbound network connections originating from the ktransformers server process, and review logs for unusual or malformed ZMQ traffic on the scheduler port. Inventory all internal hosts running ktransformers (via package/process scanning) since exposure is often unintentional in internal-only deployments that assumed network isolation was sufficient authentication.

What systems are affected by CVE-2026-63767?

This vulnerability affects the following AI/ML architecture patterns: model serving, distributed inference, agent frameworks.

What is the CVSS score for CVE-2026-63767?

CVE-2026-63767 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 1.12%.

What is the AI security impact?

Affected AI Architectures

model servingdistributed inferenceagent frameworks

MITRE ATLAS Techniques

AML.T0011.000 Unsafe AI Artifacts

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can exploit malicious __reduce__ methods embedded in crafted pickle payloads to execute arbitrary shell commands as the server process.

Exploitation Scenario

An attacker scans public or internal IP ranges for open ZMQ ROUTER ports typical of ktransformers' SchedulerServer deployment, or discovers the exposure via a misconfigured cloud security group on a self-hosted LLM inference server. They connect to the socket and send a crafted pickle payload embedding a malicious __reduce__ method designed to execute a reverse shell or download-and-execute command. Because the socket performs no authentication and deserializes the payload directly, the malicious code runs immediately as the server process — no credentials, no user click, no prior access required. From there, the attacker has a foothold on the inference host with access to model weights, GPU resources, and any adjacent internal services, which they can use for data exfiltration, cryptomining, or further lateral movement into the organization's AI infrastructure.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.