CVE-2026-49950

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-49950

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49950.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-49950

Published

2026-10-13T20:20:36Z

Modified

2026-10-14T10:47:01Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool

Details

Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle reduce gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-502"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49950.json"
}

References

Affected packages

Git / github.com/xorbitsai/xoscar

Affected ranges

Type

GIT

Repo

https://github.com/xorbitsai/xoscar

Events

Introduced

064891423f0f061d894008797fc1169227cca0b7

Last Affected

ef2af816d34f3493bab9b5736fa612f78c7ef1a8

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.1.0"
        },
        {
            "last_affected":  "0.11.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*

0.7.4

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.10.0

v0.10.1

v0.11.0

v0.11.1

v0.11.2

v0.2.0

v0.2.1

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.5.0

v0.6.0

v0.6.1

v0.6.2

v0.7.0

v0.7.0.rc1

v0.7.1

v0.7.10

v0.7.11

v0.7.12

v0.7.13

v0.7.14

v0.7.15

v0.7.16

v0.7.17

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

v0.8.0

v0.8.0.rc1

v0.8.1

v0.9.0

v0.9.1

v0.9.10

v0.9.11

v0.9.12

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49950.json"