Xorbits Xoscar: Unauthenticated deserialization leading to remote code execution
Summary
Xoscar, the actor and RPC framework used by Xinference, deserializes data received over the actor-pool TCP channel with cloudpickle before validating the message. A remote attacker with network access to an actor port can send crafted data and execute arbitrary code as the server process, which commonly runs as root on GPU nodes. No authentication is required for the vulnerable path, and the HTTP API login does not protect actor ports.
Affected
- Xoscar 0.1.0 to 0.11.2
- Xinference distributions that depend on affected Xoscar versions (distributed mode)
- Default single-node installations are much less exposed, as the actor pool listens on a random local port
Fixed in
- Xoscar 0.12.0 (released 2026-10-16) adds opt-in actor transport authentication (HMAC-SHA256, enabled via XOSCAR_AUTH_KEY)
- Xinference 4.0.1 (released 2026-10-16) requires Xoscar 0.12.0 or later
- Authentication is disabled by default: upgrading alone does not protect actor ports
Workaround
- Keep actor-pool ports off untrusted networks
- Check the bind address of distributed Xinference deployments; a third-party write-up states the pool binds to 0.0.0.0 by default (unconfirmed)
- Restrict access with firewalls or network segmentation
- Set XOSCAR_AUTH_KEY to a nonempty value on every process in the cluster
Exploitation
- VulnCheck states it verified the issue by source review and by a working exploit against a live actor pool
- A third-party write-up references a go-exploit module for this CVE; public release unverified
- Not confirmed as exploited in the wild
- CISA KEV status: unknown; CISA SSVC assessment: exploitation none, automatable no, technical impact total
Our recommendation
- Inventory all Xinference and Xoscar installations, including pip dependencies and containers
- Upgrade to Xoscar 0.12.0 or later and Xinference 4.0.1 or later
- Set XOSCAR_AUTH_KEY on all processes in the cluster after upgrading
- Until then, block actor ports from untrusted networks and check for unexpected connections
- Monitor for unexpected connections to actor-pool ports
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Xoscar v0.11.2 socket.py (CVE-relevant code) github.com
- Xoscar v0.11.2 core.pyx (CVE-relevant code) github.com
- VulnCheck advisory: Xorbits Xoscar unauthenticated deserialization RCE www.vulncheck.com
- VulnCheck blog: Xorbits Xoscar unauthenticated cloudpickle RCE www.vulncheck.com
- Xoscar release v0.12.0 github.com
- Xinference release v4.0.1 github.com
- Chocapikk write-up: Xorbits Xoscar unauth cloudpickle RCE chocapikk.com
- Strix CVE record CVE-2026-49950 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:12.
Original description (NVD)
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.
NVD references (4)
- https://github.com/xorbitsai/xoscar/blob/v0.11.2/python/xoscar/backends/communication/socket.py#L99-L104
- https://github.com/xorbitsai/xoscar/blob/v0.11.2/python/xoscar/serialization/core.pyx#L260
- https://www.vulncheck.com/advisories/xorbits-xoscar-unauthenticated-deserialization-rce-via-actor-pool
- https://www.vulncheck.com/blog/xorbits-xoscar-unauth-cloudpickle-rce
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.