Horovod through version 0.28.1 exposes an insecure deserialization vulnerability in its KVStore HTTP server component. The server accepts HTTP PUT requests without authentication or authorization, allowing an attacker to write arbitrary data. When a Horovod worker later reads data via HTTP GET, it reconstructs the payload with cloudpickle.loads() without source validation, leading the worker to deserialize a malicious pickle and execute arbitrary code. This flaw enables remote code execution on any machine running a vulnerable Horovod worker that polls the KVStore.

The vulnerability affects any installation of Horovod up to and including version 0.28.1. Any environment that deploys Horovod’s distributed KVStore service without additional access controls is susceptible.

The flaw carries an extremely high CVSS score of 9.8 due to its remote code execution impact, and the EPSS score is < 1%. The CVE is not listed in CISA’s KEV catalog, yet the lack of authentication means an attacker can reach the deserialization endpoint from any address that can reach the KVStore. Exploitation requires only the ability to send a crafted HTTP PUT request and a subsequent GET request by a worker; no privileged user context is needed on the victim host.