plaincve:~$

// threat brief

CVE-2026-49950

Xorbits Xoscar actor-pool unsafe deserialization: remote code execution with no login

CVSS
9.3 CRITICAL
CISA KEV
Not listed
Weakness
CWE-502
Topics
Infrastructure

PlainCVE Team · Published 2026-10-14 · AI-assisted · Press brief ↓

AI review 2026-10-14 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

Xoscar 0.1.0 through 0.11.2 (inclusive) deserializes network data unsafely, so anyone who can reach the actor-pool port can run code without logging in.

Who is affectedSystems running xoscar 0.1.0 through 0.11.2 (inclusive) where an attacker can reach the actor-pool TCP channel over the network (exposure to untrusted networks makes this far more likely).
What happensAn attacker can run arbitrary code as the server process. According to the CNA, that process commonly runs as root on GPU nodes, though this is not guaranteed.
What to do nowNo source names a fixed version yet. Until one exists, limit the actor-pool TCP port to trusted networks (a third-party suggestion) and watch for a new release from the project.
Affected versions0.1.0 through 0.11.2 (inclusive)
Fixed versionsUnconfirmed: no source names a fixed version
CVSS vector
Show full vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Timeline
  • First public 2026-10-13

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check the installed xoscar version

    Versions 0.1.0 through 0.11.2 (inclusive) are affected. xoscar may be pulled in by another package rather than installed directly, so check every Python environment.

    Read-only check
    pip show xoscar | grep -i '^version'
  2. 02Find actor-pool ports reachable from outside

    Exploitation needs network access to the actor-pool TCP channel; ports reachable from untrusted networks are the highest-risk exposure. Review firewalls, cloud security groups and container port mappings (PlainCVE suggestion).

    Step 1
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Restrict the actor-pool channel to trusted networks

    OffSeq (an AI-generated third-party analysis) suggests allowing only trusted networks to reach the actor-pool TCP channel until an official fix exists, using network-level controls to block untrusted connections. This is not vendor advice.

    Step 1Step 2
  2. 02Watch for a fixed release

    So far no source names a fixed version, fix commit or vendor advisory. Keep an eye on xorbitsai/xoscar releases and GHSA-5rfg-55mw-4h28.

    Step 3
RESPONDRespondIf you find signs of compromise
  1. 01If it was exposed, treat the host as possibly compromised

    If an affected version's actor-pool port was open to untrusted networks, investigate the host and rotate credentials stored on it. This is a precautionary PlainCVE suggestion; no source confirms real-world exploitation, and no vendor response guidance appears in the evidence.

    Step 4
HARDENHardenPrevent the next one
  1. 01Don't run the service as root

    The CNA notes the server process commonly runs as root on GPU nodes. Using a lower-privilege account limits the damage of a compromise (PlainCVE suggestion).

    Step 4
  2. 02Keep internal cluster traffic on an isolated network

    Internal ports of distributed computing frameworks often trust whoever connects, so they should not be exposed to the internet or shared networks (PlainCVE suggestion).

    Step 1
Full remediation steps and notes

There is no confirmed fixed version yet; OffSeq’s third-party feed also says patch status is not confirmed.

  1. Run pip show xoscar in every Python environment to check the version, including inside container images.
  2. Until an official fix exists, follow OffSeq’s suggestion (an AI-generated third-party analysis) to allow only trusted networks to reach the actor-pool TCP channel. This is not vendor advice, but without a patch it is the most direct way to reduce risk.
  3. When a fix is released, upgrade based on the vendor’s release notes rather than guessing from version numbers.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

Xorbits Xoscar actor-pool unsafe deserialization: remote code execution with no login: 1. Reaches the actor-pool TCP channel → 2. Sends crafted data → 3. The data is turned back into objects before its message type is checked → 4. Arbitrary code runs as the server processCVE-2026-49950 · Xorbits Xoscar actor-pool unsafe deserialization: remote code executionwith no loginAttackerYour systemReaches the actor-pool TCP channel — The attacker only needs network access to this port. No account or password is required. 1Reaches theactor-pool TCPchannelSends crafted data — Xoscar does not check who is sending before it processes the data. The CNA's score also says no user interaction is needed. 2Sends crafted dataThe data is turned back into objects before its message type is checked — According to the CNA, SocketChannel.recv() hands unvalidated data to cloudpickle.loads(). The pickle format can run code during restoration, before any type check happens. 3The data is turnedback into objectsbefore its messagetype is checkedArbitrary code runs as the server process — According to the CNA, this process commonly runs as root on GPU nodes. (PlainCVE analysis) If it runs as root, the impact could extend to the whole host. 4Arbitrary coderuns as the serverprocessAttack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-49950-xoscar-actor-pool-deserialization-rce · CC BY 4.0
Xorbits Xoscar actor-pool unsafe deserialization: remote code execution with no login: 1. Reaches the actor-pool TCP channel → 2. Sends crafted data → 3. The data is turned back into objects before its message type is checked → 4. Arbitrary code runs as the server processCVE-2026-49950 · Xorbits Xoscaractor-pool unsafe deserialization:remote code execution with no loginReaches the actor-pool TCP channel — The attacker only needs network access to this port. No account or password is required. 1AttackerReaches the actor-pool TCPchannelSends crafted data — Xoscar does not check who is sending before it processes the data. The CNA's score also says no user interaction is needed. 2AttackerSends crafted dataThe data is turned back into objects before its message type is checked — According to the CNA, SocketChannel.recv() hands unvalidated data to cloudpickle.loads(). The pickle format can run code during restoration, before any type check happens. 3Your systemThe data is turned back intoobjects before its message typeis checkedArbitrary code runs as the server process — According to the CNA, this process commonly runs as root on GPU nodes. (PlainCVE analysis) If it runs as root, the impact could extend to the whole host. 4Your systemArbitrary code runs as theserver processAttack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-49950-xoscar-actor-pool-deserialization-rce
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    Reaches the actor-pool TCP channel

    The attacker only needs network access to this port. No account or password is required.

    Defense: Limit the actor-pool port to trusted networks (a third-party suggestion from OffSeq, not the vendor).

  2. Attacker

    Sends crafted data

    Xoscar does not check who is sending before it processes the data. The CNA's score also says no user interaction is needed.

  3. Your system

    The data is turned back into objects before its message type is checked

    According to the CNA, SocketChannel.recv() hands unvalidated data to cloudpickle.loads(). The pickle format can run code during restoration, before any type check happens.

    Defense: No confirmed official fix exists yet.

  4. Your system

    Arbitrary code runs as the server process

    According to the CNA, this process commonly runs as root on GPU nodes. (PlainCVE analysis) If it runs as root, the impact could extend to the whole host.

    Defense: Don't run the Xoscar process as root, to limit the damage if it is compromised (PlainCVE suggestion).

Who is affected

ConditionAffected?
xoscar 0.1.0 through 0.11.2 (inclusive), with the actor-pool TCP channel reachable from an untrusted networkAffected and remotely exploitable
xoscar 0.1.0 through 0.11.2, with the actor pool reachable only on a trusted internal networkVersion is still affected; a remote attacker would first need access to that network
Versions after 0.11.2Unconfirmed: no source names a fixed version

The affected range comes from VulnCheck’s advisory and the CVE record. VulnCheck assigned the CVE as a CNA (an organization authorized to assign CVE IDs); it is not Xorbits, the developer of Xoscar. No vendor security advisory appears in the evidence. The GitHub Advisory Database lists it as GHSA-5rfg-55mw-4h28, marked as not yet reviewed by GitHub.

How it works

Xoscar is a distributed computing framework in which groups of processes (actor pools) send messages to each other over TCP. When sending, objects are “serialized” into bytes; when receiving, they are “deserialized” back into objects.

According to the CNA, SocketChannel.recv() hands unvalidated data from the network straight to cloudpickle.loads(). pickle is Python’s object format, and by design it lets the data name functions to call while it is being restored. So before the program gets a chance to check what kind of message it received, code smuggled in by the attacker has already run. And because this channel requires no authentication, reaching the port is enough. This weakness maps to CWE-502 (deserialization of untrusted data).

In the vendor’s v0.11.2 source, SocketChannel.recv() does pass the header and buffers it reads to deserialize(), and the serialization module imports cloudpickle. Our analysis: this is consistent with the CNA’s description. In the core.pyx snapshot we captured, unpickle_buffers() contains a cloudpickle.loads call, close to the location the CNA cites; but the snapshot has no line numbers, so we cannot confirm it is the CNA’s line 260, and we have not traced the full path from recv() to that call step by step.

The flawed approach (conceptual illustration, not the original source code):

Show code example(python)
data = sock.read()
msg = cloudpickle.loads(data)   # restoring may already call functions named in the data
if not isinstance(msg, KnownMessage):  # this check comes too late
    raise ValueError

A safer approach (general principle, not the official fix):

Show code example(python)
peer = authenticate(sock)        # first confirm the peer is a trusted cluster member
data = sock.read()
msg = parse_safe_format(data)    # use a format that cannot run code for external data
validate_type(msg)

Timeline

DateEvent
2026-06-02CVE ID reserved
2026-10-13CVE record published (CNA: VulnCheck)
2026-10-14Not listed in CISA KEV; NVD status is “Received” (received, not yet analyzed)

Further reading

  • Scoring differences: the CNA’s CVSS 4.0 score is 9.3 and its CVSS 3.1 score is 9.8. Different sites quote different numbers because they use different CVSS versions; the scores do not contradict each other. NVD has not analyzed the record and has no score of its own.
  • Exploitation: as of 2026-10-14 it is not in CISA KEV. There is no evidence either way on exploitation in the wild, or on exploitation before a fix existed; the CNA’s CVSS 4.0 record also leaves exploit maturity undefined.
  • Privileges: code runs as the server process. The CNA says this commonly runs as root on GPU nodes, which is typical but not guaranteed.
  • Credit: Valentin Lobstein (Chocapikk).
  • Vendor: no xorbitsai advisory, security issue or release note appears in the evidence. The open-issues list we captured shows no related report, but that alone does not prove none exists.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-14 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. CVE / NVD / OSVCVE-2026-49950 (CVE record, JSON) · CVE Program (CNA: VulnCheck), 2026-10-13 · accessed 2026-10-14
  2. CVE / NVD / OSVNVD API - CVE-2026-49950 · NIST · accessed 2026-10-14
  3. AdvisoryXorbits Xoscar Unauthenticated Deserialization RCE via Actor Pool · VulnCheck · accessed 2026-10-14
  4. AdvisoryGitHub Advisory Database entry for CVE-2026-49950 (GHSA-5rfg-55mw-4h28, unreviewed) · GitHub · accessed 2026-10-14
  5. OtherCVE-2026-49950 scores · ThreatINT · accessed 2026-10-14
  6. ResearchCVE-2026-49950: Deserialization of Untrusted Data in xorbitsai xoscar · OffSeq Radar · accessed 2026-10-14
  7. Vendorxoscar v0.11.2 socket.py · xorbitsai (GitHub) · accessed 2026-10-14
  8. Vendorxoscar v0.11.2 serialization/core.pyx · xorbitsai (GitHub) · accessed 2026-10-14

Press brief

In one sentence

Xoscar is a Python distributed computing framework from Xorbits. Versions 0.1.0 through 0.11.2 turn data received over the network straight back into program objects, so anyone who can reach its actor-pool port can run code on the server without logging in. The CVE was published on October 13, 2026, with a CNA score of 9.3 under CVSS 4.0; so far no source names a fixed version.

Key facts

Severity
CVSS 4.0 9.3 (CNA); CVSS 3.1 9.8 cve.threatint.com
Affected versions
xoscar 0.1.0 through 0.11.2 (inclusive) vulncheck.com
CVE published
2026-10-13 cveawg.mitre.org
Credited finder
Valentin Lobstein (Chocapikk) vulncheck.com
CNA
VulnCheck (not the vendor) cveawg.mitre.org

Confirmed

  • xoscar 0.1.0 through 0.11.2 has an unauthenticated deserialization flaw in the actor-pool TCP channel that allows remote code execution (CNA record).
  • In the vendor's v0.11.2 source, SocketChannel.recv() passes the data it reads from the socket to deserialize().
  • As of 2026-10-14, it is not listed in CISA KEV.

Unconfirmed / disputed

  • No source names a fixed version or fix commit, and no vendor advisory appears in the evidence we reviewed.
  • There is no evidence either way on exploitation in the wild, or on whether it was exploited before a fix existed.
  • The captured source snapshot shows a cloudpickle.loads call inside unpickle_buffers(), but the snapshot has no line numbers, so we cannot confirm it is the line 260 cited by the CNA; we have not traced the full path from recv() to that call step by step.

Quotable line

The trouble here is that the program unpacks a stranger's parcel before it checks who sent it.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "Xorbits Xoscar actor-pool unsafe deserialization: remote code execution with no login". PlainCVE. https://plaincve.date/en/vulns/cve-2026-49950-xoscar-actor-pool-deserialization-rce (accessed YYYY-MM-DD)
BibTeX
@misc{cve202649950xoscaractorpooldeserializationrce2026,
  title  = {Xorbits Xoscar actor-pool unsafe deserialization: remote code execution with no login},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-49950-xoscar-actor-pool-deserialization-rce},
  note   = {Updated 2026-10-14}
}