CVE-2025-62703: Fugue-project Fugue RCE Vulnerability

CVE-2025-62703 Overview

CVE-2025-62703 is a remote code execution vulnerability in Fugue, a unified interface for distributed computing on Spark, Dask, and Ray. The flaw exists in FlaskRPCServer and affects versions 0.9.2 and prior. The _decode() function in fugue/rpc/flask.py passes incoming RPC data directly to cloudpickle.loads() without sanitization. An attacker on an adjacent network can send a crafted serialized Python object to the RPC server and execute arbitrary code on the host. The issue is classified as insecure deserialization [CWE-502] and has been patched in commit 6f25326.

Critical Impact
Unauthenticated adjacent-network attackers can achieve arbitrary code execution on Fugue RPC servers by sending malicious pickle payloads.

Affected Products

Fugue (fugue-project/fugue) versions 0.9.2 and prior
Distributed computing deployments using FlaskRPCServer
Python environments embedding Fugue RPC functionality

Discovery Timeline

2025-11-25 - CVE-2025-62703 published to NVD
2025-12-30 - Last updated in NVD database

Technical Details for CVE-2025-62703

Vulnerability Analysis

Fugue exposes a Remote Procedure Call (RPC) server through FlaskRPCServer to support distributed computing operations. Clients communicate with the server by serializing Python objects with cloudpickle and sending them over HTTP. The server-side _decode() function in fugue/rpc/flask.py directly invokes cloudpickle.loads() on the received payload. No validation, signing, or authentication occurs before deserialization. Because pickle and cloudpickle permit arbitrary callable execution during object reconstruction through __reduce__, any deserialized payload can run shell commands or import malicious modules. The vulnerability allows full code execution in the context of the Fugue process, exposing data, credentials, and downstream Spark, Dask, or Ray cluster resources.

Root Cause

The root cause is trusting untrusted input during deserialization [CWE-502]. The _decode() routine treats inbound RPC bytes as safe and passes them straight into cloudpickle.loads(). Pickle-family formats are designed for trusted data and execute object constructors during load, which makes them unsuitable for network-facing transports without integrity controls.

Attack Vector

An attacker with network reachability to the FlaskRPCServer listener sends an HTTP request containing a crafted cloudpickle payload. The payload's __reduce__ method returns a callable such as os.system or subprocess.Popen with attacker-controlled arguments. When the server decodes the request, the callable executes inside the Fugue worker, providing code execution without authentication or user interaction.

python

# Patch excerpt - fugue/rpc/flask.py
            -1.0 if timeout is None else to_timedelta(timeout).total_seconds()
        )
        self._server: Optional[FlaskRPCServer._Thread] = None
+       self._log = logging.getLogger()

    def make_client(self, handler: Any) -> RPCClient:
        """Add ``handler`` and correspondent :class:`~.FlaskRPCClient`

Source: GitHub Commit 6f25326. The commit adds security warnings to the Flask RPC server to alert operators that the transport must not be exposed to untrusted networks.

Detection Methods for CVE-2025-62703

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running Fugue workloads, such as sh, bash, or curl.
Inbound HTTP POST requests to FlaskRPCServer endpoints from hosts outside the trusted Spark, Dask, or Ray cluster.
Outbound network connections from Fugue workers to unfamiliar IP addresses immediately following RPC traffic.
Modifications to user crontabs, SSH authorized_keys, or environment files on hosts running Fugue.

Detection Strategies

Inspect Fugue process telemetry for cloudpickle.loads execution paths followed by os.system, subprocess, or exec calls.
Alert on Fugue worker processes initiating outbound shells or downloading remote payloads.
Correlate Flask access logs with downstream process creation events to identify deserialization-triggered execution.

Monitoring Recommendations

Capture and retain HTTP request bodies sent to Fugue RPC endpoints for forensic review of pickle magic bytes (\\x80\\x04).
Forward host, network, and application logs into a centralized analytics platform for cross-source correlation.
Baseline normal RPC client IP ranges and alert on connections originating outside that set.

How to Mitigate CVE-2025-62703

Immediate Actions Required

Upgrade Fugue to the version containing commit 6f25326 or later.
Restrict FlaskRPCServer listeners to loopback or trusted management networks using firewall rules.
Audit existing deployments for exposure on shared cloud subnets or public interfaces.
Rotate credentials and tokens accessible from any Fugue host that may have been reachable by untrusted clients.

Patch Information

The maintainers addressed the issue in commit 6f25326 and published GitHub Security Advisory GHSA-xv5p-fjw5-vrj6. Operators should pin Fugue to a release that includes this commit and review release notes for additional hardening guidance.

Workarounds

Run Fugue only inside isolated environments where the RPC port is unreachable from untrusted networks.
Place the RPC endpoint behind an authenticated reverse proxy that enforces mutual TLS and IP allowlisting.
Disable FlaskRPCServer if RPC functionality is not required by the workload.

bash

# Restrict FlaskRPCServer to loopback and block external access
iptables -A INPUT -p tcp --dport 5000 ! -s 127.0.0.1 -j DROP

# Verify installed Fugue version contains the fix
pip show fugue | grep -i version