All vulnerabilities
CVE-2026-31234GHSA-mf8f-x4r3-jm8cPYSEC-2026-354

Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component

n/a horovodpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.69%Chance of exploitation activity in the next 30 days, higher than 52% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published12 May 2026Updated 27 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component. The KVStore server, used for distributed task coordination, lacks authentication and authorization controls, allowing any remote attacker to write arbitrary data via HTTP PUT requests. When a Horovod worker reads data from the KVStore (via HTTP GET), it deserializes the data using cloudpickle.loads() without verifying its source or integrity. An attacker can exploit this by sending a malicious pickle payload to the server before the legitimate data is written, causing the victim worker to deserialize and execute arbitrary code, leading to remote code execution.

Text from CVE List

Affected versions 53

  • horovod, pip<= 0.28.1GitHub
  • n/aaffected: n/aCVE List
  • horovod, PyPIfrom first release, through 0.28.1OSV
  • horovod, PyPI0.10.0OSV
  • horovod, PyPI0.10.1OSV
  • horovod, PyPI0.10.2OSV
  • horovod, PyPI0.11.0OSV
  • horovod, PyPI0.11.1OSV
  • horovod, PyPI0.11.2OSV
  • horovod, PyPI0.11.3OSV
  • horovod, PyPI0.12.0OSV
  • horovod, PyPI0.12.1OSV
  • horovod, PyPI0.13.0OSV
  • horovod, PyPI0.13.1OSV
  • horovod, PyPI0.13.10OSV
  • horovod, PyPI0.13.11OSV
  • horovod, PyPI0.13.2OSV
  • horovod, PyPI0.13.3OSV
  • horovod, PyPI0.13.4OSV
  • horovod, PyPI0.13.5OSV
  • horovod, PyPI0.13.6OSV
  • horovod, PyPI0.13.7OSV
  • horovod, PyPI0.13.8OSV
  • horovod, PyPI0.14.0OSV
  • horovod, PyPI0.14.1OSV
  • horovod, PyPI0.15.0OSV
  • horovod, PyPI0.15.1OSV
  • horovod, PyPI0.15.2OSV
  • horovod, PyPI0.16.0OSV
  • horovod, PyPI0.16.1OSV
  • horovod, PyPI0.16.2OSV
  • horovod, PyPI0.16.3OSV
  • horovod, PyPI0.16.4OSV
  • horovod, PyPI0.18.0OSV
  • horovod, PyPI0.18.1OSV
  • horovod, PyPI0.18.2OSV
  • horovod, PyPI0.19.0OSV
  • horovod, PyPI0.19.1OSV
  • horovod, PyPI0.19.2OSV
  • horovod, PyPI0.19.3OSV
  • horovod, PyPI0.19.4OSV
  • horovod, PyPI0.19.5OSV
  • horovod, PyPI0.20.0OSV
  • horovod, PyPI0.20.1OSV
  • horovod, PyPI0.20.2OSV
  • horovod, PyPI0.20.3OSV
  • horovod, PyPI0.21.0OSV
  • horovod, PyPI0.21.1OSV
  • horovod, PyPI0.21.2OSV
  • horovod, PyPI0.21.3OSV
  • horovod, PyPI0.22.0OSV
  • horovod, PyPI0.22.1OSV
  • horovod, PyPI0.23.0OSV

References 6