CVE-2026-63767: ktransformers RCE Vulnerability

CVE-2026-63767 Overview

CVE-2026-63767 is an unauthenticated pickle deserialization vulnerability [CWE-502] in ktransformers versions through 0.6.3. The flaw resides in the SchedulerServer ZeroMQ (ZMQ) ROUTER socket, which the service binds to all network interfaces (tcp://*). Remote attackers can send crafted pickle payloads containing malicious __reduce__ methods to execute arbitrary shell commands as the server process. No authentication is required to reach the vulnerable socket. The maintainers fixed the issue in commit def0f93 by binding the socket to 127.0.0.1.

Critical Impact
Unauthenticated remote code execution against any exposed ktransformers scheduler port, resulting in full compromise of the host running the inference service.

Affected Products

ktransformers (kvcache-ai/ktransformers) versions through 0.6.3
Deployments exposing the SchedulerServer ZMQ ROUTER socket on sched_port
Systems running the unpatched balance_serve/sched_rpc.py scheduler component

Discovery Timeline

2026-07-20 - CVE-2026-63767 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63767

Vulnerability Analysis

The ktransformers project provides a high-performance inference framework for large language models. Its balance_serve component includes a SchedulerServer that exposes a ZMQ ROUTER socket for RPC communication with worker processes. The scheduler deserializes incoming messages with Python's pickle module without validating the sender or the payload.

Because pickle.loads() invokes arbitrary constructors during deserialization, any object providing a __reduce__ method can trigger code execution. An attacker who reaches the exposed port can send a crafted payload whose reducer returns a call to os.system or subprocess.Popen, achieving command execution as the scheduler process user.

Root Cause

The scheduler bound its RPC socket to all interfaces using self.frontend.bind(f"tcp://*:{main_args.sched_port}"). This design assumed a trusted network boundary but combined a network-reachable endpoint with unsafe deserialization of untrusted input. The underlying weakness maps to CWE-502 (Deserialization of Untrusted Data).

Attack Vector

Exploitation requires only network reachability to the scheduler port. An attacker connects to the ZMQ ROUTER endpoint and sends a pickle blob whose top-level object defines a malicious __reduce__. When the scheduler calls pickle.loads() on the frame, Python invokes the reducer's callable with the supplied arguments, executing attacker-controlled shell commands. No credentials, tokens, or prior access are required.

python

# Vulnerable code before the patch (balance_serve/sched_rpc.py)
self.context = zmq.Context()
self.frontend = self.context.socket(zmq.ROUTER)
print(f"sched zmq rpc server on port {main_args.sched_port}")
-self.frontend.bind(f"tcp://*:{main_args.sched_port}")
+self.frontend.bind(f"tcp://127.0.0.1:{main_args.sched_port}")

self.backend = self.context.socket(zmq.DEALER)
self.backend.bind("inproc://backend")

Source: GitHub commit def0f93. The patch restricts the socket to the loopback interface, eliminating remote reachability while leaving the unsafe deserialization in place for local IPC.

Detection Methods for CVE-2026-63767

Indicators of Compromise

Unexpected outbound network connections or shell processes spawned by the ktransformers scheduler process.
Inbound TCP connections to the sched_port from non-localhost or non-worker source addresses.
Presence of the SchedulerServer binding on 0.0.0.0 rather than 127.0.0.1 in process socket listings.
Child processes such as /bin/sh, bash -c, curl, or wget under the scheduler's parent PID.

Detection Strategies

Inspect running processes with ss -ltnp or netstat -ltnp for ktransformers scheduler ports bound to wildcard addresses.
Monitor process creation telemetry for shell interpreters spawned as children of the ktransformers Python process.
Deploy network IDS rules that flag ZMQ traffic to scheduler ports originating from outside expected inference cluster ranges.

Monitoring Recommendations

Enable EDR command-line auditing on hosts running ktransformers and alert on scheduler-spawned subprocesses.
Log and review firewall connections destined for the configured sched_port value.
Track version metadata for ktransformers installations and alert when versions at or below 0.6.3 are observed.

How to Mitigate CVE-2026-63767

Immediate Actions Required

Upgrade ktransformers to a build that includes commit def0f93 or later.
Block external access to the scheduler port at the host firewall until patched.
Audit all ktransformers deployments to confirm the scheduler socket is bound to 127.0.0.1.
Rotate any credentials or keys stored on hosts that previously exposed the vulnerable port.

Patch Information

The fix is available in commit def0f9313d6e063b5c5ccdfa1f6707f7a40dfdca, merged via Pull Request #2091 in response to Issue #2087. Additional context is available in the VulnCheck Security Advisory. The patch changes the ZMQ socket bind from tcp://* to tcp://127.0.0.1, restricting the scheduler RPC surface to the local host.

Workarounds

Restrict inbound traffic to the scheduler port using host firewalls (iptables, nftables, or cloud security groups) to allow only loopback or trusted worker IPs.
Run ktransformers inside a network namespace or container with no external network exposure on the scheduler port.
Place the inference host behind a reverse proxy that terminates only the intended HTTP API and blocks direct ZMQ access.

bash

# Temporary firewall workaround: restrict scheduler port to loopback only
SCHED_PORT=5555
sudo iptables -A INPUT -p tcp --dport ${SCHED_PORT} ! -s 127.0.0.1 -j DROP
sudo iptables -A INPUT -p tcp --dport ${SCHED_PORT} -s 127.0.0.1 -j ACCEPT

# Verify the scheduler is bound to loopback after upgrading
ss -ltnp | grep ${SCHED_PORT}