Insecure Deserialization Vulnerability in Horovod KVStore HTTP Server

CVE-2026-31234

What is CVE-2026-31234?

Horovod, an open-source distributed training framework, contains a serious flaw in its KVStore HTTP server component, specifically an insecure deserialization vulnerability. This issue arises from the absence of proper authentication and authorization mechanisms, enabling any remote attacker to manipulate data via HTTP PUT requests. Without checks on the source or integrity of the data, when a Horovod worker processes this data through HTTP GET requests, it misuses the cloudpickle.loads() function to deserialize potential malicious payloads. This can result in the execution of arbitrary code, allowing attackers to exploit the system and execute unauthorized commands.

References