Xorbits Xoscar Unauthenticated RCE via Cloudpickle Deserialization

VulnCheck has disclosed CVE-2026-49950, a critical deserialization vulnerability in Xoscar, the Python actor framework underpinning the Xorbits AI stack and Xinference. The vulnerability allows an unauthenticated attacker to achieve remote code execution (RCE) by sending a specially crafted message to the actor pool's TCP port. The issue resides in the transport layer where `cloudpickle.loads()` is called on incoming messages before any authentication or message-type validation occurs.

Technically, the vulnerability mirrors the "ShadowRay" (CVE-2023-48022) flaw. In distributed configurations, Xinference workers and supervisors bind to `0.0.0[.]0` by default, exposing the actor pool to the network. An attacker with internal network access can execute arbitrary code—often with root privileges on GPU-enabled nodes—by leveraging a `__reduce__` gadget within a single binary frame.

This is a high-impact vulnerability for organizations using Xorbits or Xinference for distributed AI workloads. As of October 2026, no official patch has been released by the vendor (v0.11.2 remains vulnerable). The primary risk involves lateral movement within clusters, model theft, and full compromise of expensive GPU infrastructure.