Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92785Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes
High 8.1
In plain English
A high-severity unsafe deserialization in angel from Angel-ML. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 50.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.
Affected products (as reported)
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Issue #1355 issue-tracking
- https://github.com/Angel-ML/angel product
- deserializeAlgoMetric reads an arbitrary class and casts only after construction technical-description
- VulnCheck Advisory: Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes third-party-advisory