CVE-2026-26210 - Vulnerability Analysis

Overview

KTransformers through 0.5.3 contains an insecure deserialization vulnerability caused by unvalidated use of pickle.loads() in the balance_serve backend mode's ZMQ ROUTER socket, letting remote attackers execute arbitrary code with ktransformers process privileges, exploit requires access to the exposed ZMQ socket.

Severity & Score

Impact

Attackers can execute arbitrary code on the server with the privileges of the ktransformers process, potentially leading to full system compromise.

Mitigation

Update to the latest version of KTransformers.

References

• https://chocapikk.com/posts/2026/ktransformers-pickle-rce/
• https://github.com/kvcache-ai/ktransformers/pull/1944
• https://www.vulncheck.com/advisories/ktransformers-unsafe-deserialization-rce-via-balance-serve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner