{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3axorbitsxoscar/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:xorbits:xoscar:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-49950"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Xoscar (\u003c= 0.11.2)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","deserialization","vulnerability","cve-2026-49950"],"_cs_type":"advisory","_cs_vendors":["Xorbits"],"content_html":"\u003cp\u003eXorbits Xoscar versions up to and including 0.11.2 are susceptible to a critical unauthenticated deserialization vulnerability, tracked as CVE-2026-49950. The vulnerability exists within the application's actor-pool TCP communication channel. Remote, unauthenticated attackers can supply crafted malicious payloads that are processed by the SocketChannel.recv() function. This input is passed directly to the cloudpickle.loads() method without prior validation of the message type. Because this processing occurs before the application verifies the data structure, attackers can trigger the execution of arbitrary code via pickle \u003cstrong\u003ereduce\u003c/strong\u003e gadgets. This attack results in remote code execution (RCE) with the privileges of the server process, which frequently runs as the root user on GPU-enabled nodes, potentially leading to full cluster compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote attackers to execute arbitrary code with root-level privileges on GPU nodes running Xoscar. This exposes the entire infrastructure to unauthorized access, data exfiltration, and potential persistence mechanisms within the targeted environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Xorbits Xoscar to a patched version beyond 0.11.2 immediately to remediate CVE-2026-49950.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation to restrict access to the actor-pool TCP ports to only authorized compute nodes.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for anomalous data structures or serialized Python objects being sent to the TCP channels used by the Xoscar actor-pool.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T22:38:48Z","date_published":"2026-10-13T22:38:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-xorbits-xoscar-deserialization/","summary":"Xorbits Xoscar versions 0.11.2 and earlier are vulnerable to unauthenticated remote code execution via insecure deserialization of data sent over the actor-pool TCP channel.","title":"Unauthenticated Remote Code Execution in Xorbits Xoscar","url":"https://feed.craftedsignal.io/briefs/2026-10-xorbits-xoscar-deserialization/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:xorbits:xoscar:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}