CVE-2026-49121
published 2026-06-01CVE-2026-49121: AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within…
PriorityP272critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.10%
61.6th percentile
AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py that allows unauthenticated remote attackers to execute arbitrary code by sending a malicious pickle payload to a ZMQ SUB socket with no authentication, HMAC, or format validation. Attackers who can reach the writer XPUB endpoint on the cluster network or supply a forged Handle with an attacker-controlled remote_subscribe_addr can deliver a crafted pickle payload that executes arbitrary code simultaneously as the inference worker process on every remote reader worker.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| amd | aiter | <= 0.1.14 | — |
| rhaiis | vllm-rocm-rhel9 | — | — |
| rhoai | odh-vllm-rocm-rhel9 | — | — |
| rocm | aiter | <= 0.1.14 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for inbound connections to ZMQ XPUB/SUB ports on inference worker nodes from untrusted or unexpected sources; any external access to these endpoints should be treated as suspicious. ↗
- →Detect Python pickle deserialization of data received from a ZMQ SUB socket in AITER's shm_broadcast.py (MessageQueue.recv()); alert on pickle.loads() calls operating on network-sourced bytes in this context. ↗
- →Flag AITER package versions 0.1.5 through 0.1.14 (inclusive) in container images, particularly rhaiis/vllm-rocm-rhel9 and rhoai/odh-vllm-rocm-rhel9, as vulnerable to unauthenticated RCE. ↗
- →Alert on forged or unexpected ZMQ Handle objects containing attacker-controlled remote_subscribe_addr fields being supplied to AITER worker processes. ↗
- ·The ZMQ SUB socket in AITER's MessageQueue has no authentication, HMAC, or format validation, meaning any node that can reach the XPUB endpoint can send arbitrary payloads with no credential requirement. ↗
- ·Exploitation requires network access to the ZMQ XPUB endpoint on the cluster network, or the ability to supply a forged distributed Handle; this is not a default internet-facing exposure but is critical within cluster networks. ↗
- ·A successful exploit delivers RCE simultaneously to every remote reader worker process, not just a single node — blast radius is the entire multi-node inference cluster. ↗
- ·Affected Red Hat container images are rhaiis/vllm-rocm-rhel9 (Red Hat AI Inference Server) and rhoai/odh-vllm-rocm-rhel9 (Red Hat OpenShift AI); single-node deployments binding ZMQ to localhost are not exposed. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
ROCm aiter up to 0.1.14 Writer XPUB Endpoint shm_broadcast.py MessageQueue.recv deserialization (Issue 3076)
vuldb·2026-06-01·CVSS 9.2
CVE-2026-49121 [CRITICAL] ROCm aiter up to 0.1.14 Writer XPUB Endpoint shm_broadcast.py MessageQueue.recv deserialization (Issue 3076)
A vulnerability classified as problematic was found in ROCm aiter up to 0.1.14. Impacted is the function MessageQueue.recv of the file shm_broadcast.py of the component Writer XPUB Endpoint. Such manipulation leads to deserialization.
This vulnerability is traded as CVE-2026-49121. The attack may be launched remotely. There is no exploit available.
It is advisable to implement a patch to correct this issue.
GHSA
AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py that allows unauthenticated
ghsa_unreviewed·2026-06-01
CVE-2026-49121 [CRITICAL] CWE-502 AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py that allows unauthenticated
AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py that allows unauthenticated remote attackers to execute arbitrary code by sending a malicious pickle payload to a ZMQ SUB socket with no authentication, HMAC, or format validation. Attackers who can reach the writer XPUB endpoint on the cluster network or supply a forged Handle with an attacker-controlled remote_subscribe_addr can deliver a crafted pickle payload that executes arbitrary code simultaneously as the inference worker process on every remote reader worker.
Red Hat
aiter: AI Tensor Engine for ROCm (AITER): Remote Code Execution via Unauthenticated Pickle Deserialization
vendor_redhat·2026-06-01·CVSS 9.8
CVE-2026-49121 [CRITICAL] CWE-502 aiter: AI Tensor Engine for ROCm (AITER): Remote Code Execution via Unauthenticated Pickle Deserialization
aiter: AI Tensor Engine for ROCm (AITER): Remote Code Execution via Unauthenticated Pickle Deserialization
AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py that allows unauthenticated remote attackers to execute arbitrary code by sending a malicious pickle payload to a ZMQ SUB socket with no authentication, HMAC, or format validation. Attackers who can reach the writer XPUB endpoint on the cluster network or supply a forged Handle with an attacker-controlled remote_subscribe_addr can deliver a crafted pickle payload that executes arbitrary code simultaneously as the inference worker process on every remote reader worker.
A flaw was found in AI Tensor Engine for ROCm
No detection rules found.
No public exploits indexed.
https://github.com/ROCm/aiter/issues/3076https://github.com/ROCm/aiter/pull/3170https://www.vulncheck.com/advisories/ai-tensor-engine-for-rocm-aiter-unauthenticated-rce-via-messagequeue-recv-pickle-deserializationhttps://access.redhat.com/security/cve/CVE-2026-49121https://bugzilla.redhat.com/show_bug.cgi?id=2483882https://github.com/ROCm/aiter/issues/3076https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49121.json
2026-06-01
Published