CVE-2026-49950 json
Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool
published 29d ago modified 26d ago also EUVD-2026-100500
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.
Is CVE-2026-49950 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 28d ago
Exploit prediction
0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- vulncheck.com https://www.vulncheck.com/blog/xorbits-xoscar-unauth-cloudpickle-rce referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Inferred packages
No advisory lists a package for this vulnerability yet. The CVE names these as products and links their GitHub repository, and the package registry names the same repository, so they are probably the affected packages. Low confidence: the versions are the CVE’s own for the product, and a stack check reports the package as unchecked when there are none.
| ecosystem | package | repository | affected |
|---|---|---|---|
| pypi | xoscar | xorbitsai/xoscar | >= 0.1.0, <= 0.11.2 |
Affected products
- xorbitsai xoscar
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
vulncheck.com
/blog/xorbits-xoscar-unauth-cloudpickle-rce
exploit, technical-description
- github.com /xorbitsai/xoscar/blob/v0.11.2/python/xoscar/serialization/core.pyx#L260
- github.com /xorbitsai/xoscar/blob/v0.11.2/python/xoscar/backends/communication/socket.py#L99-L104
-
vulncheck.com
/advisories/xorbits-xoscar-unauthenticated-deserialization-rce-via-actor-pool
third-party-advisory
Sources
- CVE List CVE-2026-49950
- NVD CVE-2026-49950
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.