EXPOSURES › CVE-2026-49950
CVE-2026-49950
CRITICALXorbits Xoscar through 0.11.2 allows unauthenticated remote code execution via unvalidated deserialization of actor-pool TCP channel data.
An unauthenticated deserialization vulnerability in Xorbits Xoscar through 0.11.2 lets attackers execute arbitrary code by sending crafted data over the actor-pool TCP channel. The exploit bypasses message type validation by triggering pickle __reduce__ gadget execution before validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes. DIB organizations must patch this immediately as it enables full system compromise without authentication, violating CMMC/NIST 800-171 requirements for preventing unauthorized access and ensuring system integrity.
Shame score — Unauthenticated remote code execution as root on GPU nodes represents a severe, avoidable failure where basic input validation was missing, allowing complete system compromise without any authentication.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.