{"id":"CVE-2026-92785","state":"PUBLISHED","title":"Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes","description":"Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.","publishedAt":"2026-09-16T20:32:41.742Z","updatedAt":"2026-09-17T15:03:38.116Z","severity":{"score":9.2,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Angel-ML angel"],"affected":[{"vendor":"Angel-ML","product":"angel","packageURL":"pkg:maven/com.tencent.angel/angel","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.0","versionType":"custom"}]}],"references":["https://github.com/Angel-ML/angel/issues/1355","https://github.com/Angel-ML/angel","https://github.com/Angel-ML/angel/blob/Release-3.3.0/angel-ps/core/src/main/java/com/tencent/angel/utils/KryoUtils.java#L45-L70","https://www.vulncheck.com/advisories/angel-through-3.3.0-unauthenticated-kryo-deserialization-of-arbitrary-classes"],"weaknesses":["CWE-502"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/92xxx/CVE-2026-92785.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-92785","state":"PUBLISHED","datePublished":"2026-09-16T20:32:41.742Z","dateUpdated":"2026-09-17T15:03:38.116Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-16T19:22:55.254Z"},"containers":{"cna":{"title":"Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes","descriptions":[{"lang":"en","value":"Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint."}],"affected":[{"vendor":"Angel-ML","product":"angel","packageURL":"pkg:maven/com.tencent.angel/angel","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.3.0","versionType":"custom"}]}],"references":[{"url":"https://github.com/Angel-ML/angel/issues/1355","tags":["issue-tracking"],"name":"GitHub Issue #1355"},{"url":"https://github.com/Angel-ML/angel","tags":["product"]},{"url":"https://github.com/Angel-ML/angel/blob/Release-3.3.0/angel-ps/core/src/main/java/com/tencent/angel/utils/KryoUtils.java#L45-L70","tags":["technical-description"],"name":"deserializeAlgoMetric reads an arbitrary class and casts only after construction"},{"url":"https://www.vulncheck.com/advisories/angel-through-3.3.0-unauthenticated-kryo-deserialization-of-arbitrary-classes","name":"VulnCheck Advisory: Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":9.2,"baseSeverity":"CRITICAL"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","lang":"en","description":"Deserialization of Untrusted Data","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-16T20:32:41.742Z"},"datePublic":"2026-07-17T00:00:00.000Z","credits":[{"lang":"en","value":"George Chen","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/Angel-ML/angel/issues/1355","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-17T15:03:22.659125Z","id":"CVE-2026-92785","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-17T15:03:38.116Z"}}]}}}