by Kastro
Paper/Archive/CVE-2026-92785

CVE-2026-92785

Angel-ML angel — Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes

EPSS 0.6%public exploitCVSS 9.2
critical.is priorityof 100
48
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 49.4.494 × 209.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.

Affected

ProductAffectedFixed inSource
angel≤ 3.3.0–CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/Angel-ML/angel/issues/1355refgithub.com/Angel-ML/angelwriteupgithub.com/Angel-ML/angel/blob/Release-3.3.0/angel-ps/core/src/main/java/com/tencent/angel/utils/KryoUtils.java#L45-L70writeupvulncheck.com/advisories/angel-through-3.3.0-unauthenticated-kryo-deserialization-of-arbitrary-classes