CVE-2026-31234

{
  "id": "CVE-2026-31234",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T18:16:51.743",
  "lastModified": "2026-10-19T22:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component. The KVStore server, used for distributed task coordination, lacks authentication and authorization controls, allowing any remote attacker to write arbitrary data via HTTP PUT requests. When a Horovod worker reads data from the KVStore (via HTTP GET), it deserializes the data using cloudpickle.loads() without verifying its source or integrity. An attacker can exploit this by sending a malicious pickle payload to the server before the legitimate data is written, causing the victim worker to deserialize and execute arbitrary code, leading to remote code execution."
    },
    {
      "lang": "es",
      "value": "Horovod hasta 0.28.1 contiene una vulnerabilidad de deserialización insegura (CWE-502) en su componente de servidor HTTP KVStore. El servidor KVStore, utilizado para la coordinación de tareas distribuidas, carece de controles de autenticación y autorización, lo que permite a cualquier atacante remoto escribir datos arbitrarios a través de solicitudes HTTP PUT. Cuando un worker de Horovod lee datos del KVStore (a través de HTTP GET), deserializa los datos usando cloudpickle.loads() sin verificar su origen o integridad. Un atacante puede explotar esto enviando una carga útil pickle maliciosa al servidor antes de que se escriban los datos legítimos, lo que hace que el worker víctima deserialice y ejecute código arbitrario, lo que lleva a la ejecución remota de código."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T17:08:45.343529Z",
          "id": "CVE-2026-31234",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/horovod/horovod",
      "source": "[email protected]"
    },
    {
      "url": "https://www.notion.so/CVE-2026-31234-35d1e139318881d585cde508b9d2453c",
      "source": "[email protected]"
    }
  ]
}