CVE-2026-92785
Last modified
CVE-2026-92785 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint..
Description
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Angel-ML | angel | <= 3.3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-92785?
How severe is CVE-2026-92785?
How do I fix CVE-2026-92785?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-9278The Form Builder CP WordPress plugin before 1.2.47 does not …5.4
- CVE-2026-92780KnowStreaming through 3.4.1 fails to enforce role-based acce…8.8
- CVE-2026-92781Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 con…6.3
- CVE-2026-92782Chroma through 1.5.9 fails to validate tenant and database s…8.1
- CVE-2026-92783Yeti through 2.11.0 fails to validate caller permissions in …8.1
- CVE-2026-92784@refinedev/inferencer through 7.0.0 fails to escape API fiel…7.5
- CVE-2026-92786LightGBM through 4.7.0 fails to validate child and split arr…7.8
- CVE-2026-92787Feast through 0.66.0 fails to verify JWT token signatures be…9.8
- CVE-2026-92788Coze Studio through 0.5.1 fails to validate that table names…8.8
- CVE-2026-92789Graylog through 7.1.4 validates outbound URLs against an all…6.5
- CVE-2026-9279Logseq exposes an IPC handler that allows the renderer proce…8.7
- CVE-2026-92790Higress before 2.2.4 panics when processing a Cookie header …6.5
Are you affected by CVE-2026-92785?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST