VulnCheck disclosed CVE-2026-49950 in Xorbits Xoscar, the actor framework behind Xinference, saying every released version through v0.11.2 is affected and no fix was available at disclosure. In distributed deployments, Xinference binds the actor pool to 0.0.0.0 by default, so the vulnerable port can be reachable on the network.
The bug sits in the transport path: Xoscar unpacks inbound TCP messages with cloudpickle before it checks what the message is and without authentication. That means a malicious message can execute code as the pool process on arrival, giving an attacker a foothold in the actor layer that can reach workers, supervisors, and model pools.
For operators running AI orchestration on internal TCP links, this is not just a single service crash or logic bug. If the actor port is reachable, the trust boundary is already broken, and cleanup has to assume the wider Xoscar-managed stack may have been exposed through that one connection.
CVSS 9.8 CRITICAL: xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. EPSS 0.6% (49th percentile).
Xorbits Xoscar: Unauthenticated RCE via Cloudpickle Deserialization in the Actor Pool | Blog | VulnCheck
VulnCheck's Initial Access Intelligence team details an unauthenticated remote code execution in Xoscar, the actor and RPC framework behind the Xinference inference stack, where the actor pool deserializes every inbound TCP message with cloudpickle before it checks the message type and with no authentication.