CVE-2026-92785: Angel Deserialization RCE Vulnerability

CVE-2026-92785 is an unsafe deserialization flaw in Angel through version 3.3.0 that enables remote code execution. Attackers can exploit Kryo deserialization to instantiate arbitrary classes or exhaust memory. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-92785 Overview

Angel, the distributed machine learning platform maintained by Tencent, contains an unauthenticated deserialization flaw in versions through 3.3.0. The Angel master exposes an RPC endpoint that accepts a setAlgoMetrics payload and deserializes it with Kryo. The implementation in KryoUtils.java does not register classes or apply an allowlist, so attackers control the type of object being instantiated. Unauthenticated network attackers can send crafted serialized objects to instantiate arbitrary classes on the coordinator or exhaust its memory. The weakness is classified under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Unauthenticated attackers reachable over the network can instantiate arbitrary classes on the Angel master or crash the coordinator through memory exhaustion.

Affected Products

Angel ML through 3.3.0
Angel angel-ps/core module using KryoUtils
Deployments exposing the Angel master RPC endpoint

Discovery Timeline

2026-09-16 - CVE-2026-92785 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92785

Vulnerability Analysis

Angel processes setAlgoMetrics payloads by passing attacker-supplied bytes to a Kryo deserializer instantiated in KryoUtils.java. Kryo can operate in a strict mode that requires each type to be registered before deserialization. Angel disables that safeguard and does not validate class names against an allowlist. Any class reachable on the master's classpath becomes a candidate for instantiation during deserialization.

An attacker who can reach the master RPC endpoint sends a crafted serialized graph. The deserializer walks the payload, invokes constructors and setters on attacker-chosen types, and consumes memory proportional to the payload structure. Gadget chains present in Angel's dependencies enable code execution paths, while nested object graphs enable denial-of-service through coordinator memory exhaustion. Refer to the VulnCheck Advisory on Angel for additional details.

Root Cause

The KryoUtils helper constructs a Kryo instance with class registration disabled and no allowlist enforcement. The setAlgoMetrics RPC handler forwards untrusted client bytes directly into that deserializer. Trust is placed in network-reachable input, which contradicts safe deserialization guidance for [CWE-502]. Review the KryoUtils Source Code for the affected constructor.

Attack Vector

Exploitation requires network access to the Angel master RPC service and no authentication. An attacker submits a setAlgoMetrics message containing a serialized payload targeting either a code-execution gadget or a memory-exhaustion structure. Successful deserialization runs attacker-controlled logic in the master JVM or terminates the coordinator. See GitHub Issue #1355 for maintainer discussion.

No verified public proof-of-concept code is available. The vulnerability behavior is described in the referenced advisory rather than demonstrated with reproducer code.

Detection Methods for CVE-2026-92785

Indicators of Compromise

Unexpected setAlgoMetrics RPC calls from clients outside the training cluster.
Angel master JVM spawning child processes such as sh, bash, python, or curl.
Sudden growth in Angel master heap usage followed by OutOfMemoryError and coordinator restart.
Outbound network connections from the master node to unfamiliar hosts shortly after RPC traffic.

Detection Strategies

Inspect Angel master logs for Kryo deserialization stack traces referencing classes outside the com.tencent.angel namespace.
Alert on process creation events where the parent process is the Angel master JVM.
Correlate RPC connection metadata with an allowlist of expected worker and client IP ranges.

Monitoring Recommendations

Ingest Angel master and worker logs into a centralized analytics pipeline for retention and correlation.
Track JVM heap, garbage collection frequency, and thread counts on the master to identify memory-exhaustion attempts.
Monitor egress network flows from training infrastructure to detect post-exploitation callbacks.

How to Mitigate CVE-2026-92785

Immediate Actions Required

Restrict network access to the Angel master RPC endpoint using firewall rules or security groups so only trusted clients can connect.
Place Angel clusters behind an authenticated ingress or VPN and remove any public exposure.
Audit setAlgoMetrics traffic and terminate sessions originating from unexpected sources.
Rotate credentials and secrets accessible from the master node if unauthorized RPC activity is observed.

Patch Information

No fixed release is identified in the referenced advisory at the time of publication. Track the Angel ML Repository and GitHub Issue #1355 for maintainer updates. Until a patched build is available, apply the workarounds below.

Workarounds

Enforce Kryo class registration or an explicit allowlist in KryoUtils builds under your control, rejecting any class outside the required set.
Deploy a network proxy in front of the master RPC endpoint that terminates untrusted sessions and enforces mutual TLS.
Run the Angel master under a low-privilege service account with SELinux or AppArmor confinement to limit post-exploitation impact.
Isolate training clusters on dedicated network segments with strict egress filtering.

bash

# Configuration example: restrict Angel master RPC to trusted subnets
iptables -A INPUT -p tcp --dport 55555 -s 10.20.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 55555 -j DROP