Loading story…
Two AI infrastructure projects, KTransformers and LeRobot, were found vulnerable to unauthenticated remote code execution caused by unsafe deserialization of attacker-controlled data with pickle.loads(). KTransformers through version 0.5.3 is affected in its balance_serve backend mode, where the scheduler RPC server binds a ZeroMQ ROUTER socket to all interfaces without authentication and processes untrusted messages, allowing an attacker to send a crafted pickle payload and execute arbitrary code with the privileges of the ktransformers process. The issue was tracked as CVE-2026-26210, mapped to CWE-502, and assigned a CVSS v3.1 score vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
LeRobot through version 0.5.1 was similarly exposed through its async inference pipeline, where policy server and robot client components deserialize data received over unauthenticated gRPC channels without TLS. A network-reachable attacker can trigger code execution on either side by sending crafted payloads through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls. That flaw, tracked as CVE-2026-25874, also carries a CWE-502 classification and a CVSS v4.0 rating reflecting low-complexity network exploitation with no privileges or user interaction and high impact to confidentiality, integrity, and availability. Public references for both issues include technical write-ups, GitHub remediation activity, and VulnCheck advisories.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
A remote code execution flaw in KTransformers was disclosed affecting versions through 0.5.3. In balance_serve backend mode, the scheduler RPC server binds a ZeroMQ ROUTER socket to all interfaces without authentication and deserializes attacker-controlled messages with pickle.loads(), enabling arbitrary code execution.
VulnCheck disclosure records show CVE-2026-25874 was received and modified on the same day to clarify that affected versions include LeRobot through 0.5.1. References added included GitHub issues, a pull request, a VulnCheck advisory, and a technical blog post.
A remote code execution vulnerability in LeRobot was documented affecting versions through 0.5.1. The flaw stems from unauthenticated gRPC communications in the async inference pipeline where pickle.loads() deserializes untrusted data in policy server and robot client components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical deserialization flaws were disclosed in multiple AI and robotics components, allowing attackers to execute arbitrary code by sending crafted `pickle` payloads to exposed services. In Hugging Face’s **LeRobot** `0.4.3`, CVE-2026-25874 affects the async inference `PolicyServer`, where the `SendPolicyInstructions` and `SendObservations` gRPC handlers call `pickle.loads()` on attacker-controlled bytes before validation. The service is exposed over an insecure gRPC port with no TLS or authentication, making network-accessible deployments vulnerable to unauthenticated remote code execution; the issue was rated **CVSS 9.8** and no fix was available at disclosure. A separate flaw, CVE-2026-26210, was reported in **ktransformers**’ legacy `balance_serve` backend, where a ZeroMQ `ROUTER` socket bound on all interfaces forwards untrusted messages to worker threads that also invoke `pickle.loads()` without authentication, enabling unauthenticated remote code execution and prompting a fix PR.
Jun 29, 2026
A critical vulnerability in **kvcache-ai ktransformers** exposed the `balance_serve` scheduler to unauthenticated remote code execution through unsafe Python pickle deserialization on a ZeroMQ ROUTER socket. The flaw, tracked as **`CVE-2026-63767`** and **`GHSA-83vp-v6wg-x93x`**, affects versions through **`0.6.3`**. The vulnerable `SchedulerServer` bound its RPC socket to all interfaces using `tcp://*`, then passed incoming messages directly to `pickle.loads()`, allowing any reachable host to send a crafted payload with a malicious `__reduce__` method and execute arbitrary shell commands as the server process. The issue was documented in a GitHub security report that validated end-to-end code execution and noted that the scheduler port is auto-assigned, requiring discovery before exploitation. Maintainers remediated the exposure in commit **`def0f9313d6e063b5c5ccdfa1f6707f7a40dfdca`**, changing the bind address to `tcp://127.0.0.1` in both affected `sched_rpc.py` paths so the scheduler is reachable only over localhost, which matches the intended `SchedulerClient` design. The vulnerability is classified as **`CWE-502`** and carries a **CVSS 3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, reflecting high risk to confidentiality, integrity, and availability.
Jul 21, 2026
Multiple high-severity deserialization vulnerabilities have been identified in widely used AI and analytics frameworks, including NVIDIA Isaac Lab, MooreThreads torch_musa, and NVIDIA Merlin components. These flaws allow attackers to exploit unsafe deserialization processes, potentially leading to remote code execution or denial-of-service conditions on affected systems. In the case of MooreThreads torch_musa, the vulnerability arises from the use of `pickle.load()` on user-controlled files without validation, enabling arbitrary code execution with the privileges of the victim process. Similarly, NVIDIA Isaac Lab and Merlin frameworks are affected by deserialization issues that could be exploited remotely, with Merlin's NVTabular and Transformers4Rec components specifically highlighted for their susceptibility to code execution and data tampering attacks. Security advisories urge immediate patching, as these vulnerabilities are remotely exploitable and pose significant risks to enterprise environments. The affected products span various versions, and organizations using these frameworks are advised to review vendor guidance and apply available security updates to mitigate the threat. The vulnerabilities have been assigned high or critical CVSS scores, underscoring the urgency for remediation to prevent potential exploitation in production environments.
Jun 29, 2026