A critical unauthenticated deserialization flaw in the ktransformers SchedulerServer lets remote attackers run arbitrary shell commands as the server process.
What Is It
CVE-2026-63767 is an unauthenticated pickle deserialization vulnerability (CWE-502) in kvcache-ai's ktransformers through version 0.6.3. The SchedulerServer exposes a ZMQ ROUTER socket bound to all interfaces. Because incoming data is deserialized with Python's pickle, a remote attacker can send a crafted payload containing a malicious __reduce__ method, causing the server to execute arbitrary shell commands as the server process. No authentication, privileges, or user interaction is required.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL), with a network attack vector, low attack complexity, and no privileges or user interaction needed. Its CVSS 4.0 score is 9.3 (CRITICAL). Confidentiality, integrity, and availability impacts are all rated HIGH. Because the socket binds to all interfaces, any network-reachable deployment can be fully compromised, giving an attacker code execution in the context of the running service.
What's Vulnerable
- Vendor / product: kvcache-ai; ktransformers (PyPI package
ktransformers) - Affected versions: all versions from 0 through and including 0.6.3
- Component: the SchedulerServer ZMQ ROUTER socket bound to all interfaces
Patch Status
The issue is fixed in commit def0f93 (def0f9313d6e063b5c5ccdfa1f6707f7a40dfdca), which is marked unaffected. Users running 0.6.3 or earlier should update to a build that includes this fix. The fix was delivered via pull request #2091, referenced against issue #2087.
Note: This CVE is not present in the supplied CISA KEV data, so no confirmation of active exploitation is available from that source.