Skip to content
Threat Feed
Subscribe

Product

Ktransformers <= 0.6.3

1 brief RSS
critical advisory

Critical Unauthenticated RCE in ktransformers (CVE-2026-63767)

A critical unauthenticated pickle deserialization vulnerability (CVE-2026-63767) in ktransformers versions up to 0.6.3 allows remote attackers to execute arbitrary commands by sending specially crafted pickle payloads containing malicious `__reduce__` methods to the SchedulerServer ZMQ ROUTER socket, leading to complete server compromise.

ktransformers <= 0.6.3 deserialization remote-code-execution python zmq vulnerability
2r 2t 1c