CVE-2026-92785

Executive Summary

Angel (a distributed machine learning / parameter server framework) through version 3.3.0 deserializes untrusted setAlgoMetrics payloads using Kryo without class registration or allowlist validation. Unauthenticated network attackers can reach the master RPC endpoint and either instantiate arbitrary classes (potentially leading to remote code execution via gadget chains) or exhaust coordinator memory via crafted serialized objects. With a CVSS base score of 8.1, this is a high-severity flaw affecting any organization running an exposed Angel master service.

Technical Analysis

The vulnerability resides in the deserialization path used by the setAlgoMetrics RPC. Angel uses Kryo as its serialization framework. Kryo, when configured without a RegistrationRequired policy or an allowlist/denylist (setInstantiatorStrategy restrictions), will happily instantiate any class name found in the serialized byte stream.

Two distinct attack primitives arise from this:

1. Arbitrary class instantiation (gadget-based RCE): An attacker supplies a serialized object graph naming classes available on the coordinator classpath. If a gadget chain exists (e.g., classes that perform JNDI lookups, dynamic proxy invocation, or bytecode definition during readObject/readResolve), the deserialization step executes attacker-controlled logic. This is the classic Java deserialization exploitation model.

2. Memory exhaustion (DoS): Even without a usable gadget chain, Kryo will allocate objects and collections based purely on attacker-supplied type and length metadata. A crafted payload declaring large arrays, deeply nested collections, or huge string buffers forces the coordinator JVM to allocate memory proportional to attacker input, triggering OutOfMemoryError and coordinator failure.

The attack surface is the master RPC endpoint—the network listener the Angel master/coordinator exposes to workers and clients. The setAlgoMetrics method is invoked by clients to publish algorithm metrics, and it accepts a serialized argument. Because the endpoint is unauthenticated (PR:N), no credentials are required.

CVSS reflects the practical difficulty: AC:H (High) because reliable exploitation of the arbitrary-instantiation path depends on the presence of a viable gadget chain and on classpath composition, not merely on reaching the endpoint. Confidentiality, Integrity, and Availability impacts are all High (C:H/I:H/A:H), consistent with full compromise of the coordinator or complete denial of service. Scope is Unchanged (S:U).

The root cause maps cleanly to CWE-502 (Deserialization of Untrusted Data). The correct fix is to enable Kryo registration requirements and/or a strict class allowlist on the RPC deserialization path, and to authenticate the master RPC endpoint.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-92785. The attack chain below is inferred from the vulnerability class (CWE-502) and the NVD description; no specific gadget classes, functions, or payload structures beyond those named in the description (setAlgoMetrics, Kryo, master RPC endpoint) are asserted.

1. Reconnaissance / target identification. An attacker scans for exposed Angel master RPC endpoints (network service reachable from the internet or from an adjacent compromised host). Fingerprinting is based on the service's RPC protocol signature and port behavior. No authentication is required to proceed.

2. Triggering the flaw class. The attacker connects to the master RPC endpoint and invokes the setAlgoMetrics method, supplying an attacker-crafted Kryo-serialized payload as the argument. Because Kryo is configured without class registration or allowlist validation, the deserializer does not reject attacker-chosen class names.

3. Payload / execution method (vulnerability-class level). The payload is delivered over the network as a serialized object stream. Two outcomes are possible:

   • Arbitrary class instantiation: the stream names classes present on the coordinator classpath. If a viable deserialization gadget chain exists, object construction during deserialization results in attacker-controlled code execution in the coordinator JVM.
   • Memory exhaustion: the stream declares excessive object counts, large arrays, or deeply nested structures, causing unbounded allocation and coordinator OOM.

4. Post-exploitation impact. Success on the RCE path yields code execution as the coordinator process — the central control point of the Angel cluster — enabling theft of model parameters/training data, tampering with distributed training jobs, lateral movement to workers, and persistence. Success on the DoS path halts cluster coordination, disrupting training and inference workloads. CVSS C:H/I:H/A:H reflects both confidentiality and integrity loss (RCE path) and the availability loss common to both paths.

Impact Assessment

Affected systems are Angel deployments through 3.3.0 with a reachable, unauthenticated master RPC endpoint. The coordinator is a high-value blast-radius node: compromise or loss of the master affects every connected worker and every job it schedules.

• Confidentiality (High): Coordinator compromise can expose model artifacts, training data references, credentials, and cluster topology.
• Integrity (High): Attacker can alter metrics, job scheduling, and (on the RCE path) running code/results.
• Availability (High): Memory-exhaustion payloads cause coordinator crashes; recovery may require restarting the coordinator and dependent jobs.
• Attack Vector (Network) / Privileges (None) / User Interaction (None): Remote, unauthenticated exploitation.
• Attack Complexity (High): Reliable arbitrary-instantiation exploitation requires a suitable gadget chain; the DoS path is simpler but bounded to availability.

Patch status is 0/4 (UNPATCHED). No vendor fix, workaround, or CVE-affected-version metadata was supplied by tracked sources. CISA KEV: NO. EPSS: not yet scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Angel Master RPC Kryo Deserialization Abuse (CVE-2026-92785)
id: 6f3a2c10-9278-4e5a-9b21-angel92785
status: experimental
description: Detects anomalous Angel coordinator behavior consistent with untrusted Kryo deserialization via setAlgoMetrics
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92785
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: angel
detection:
  selection_err:
    message|contains:
      - 'KryoException'
      - 'ClassNotFoundException'
      - 'InvalidClassException'
      - 'OutOfMemoryError'
  selection_ctx:
    message|contains:
      - 'setAlgoMetrics'
      - 'deserializ'
  condition: selection_err and selection_ctx
falsepositives:
  - Legitimate metrics submissions with malformed client payloads
level: high
tags:
  - attack.t1190
  - cve.2026.92785

YARA Rule

rule CVE_2026_92785_Angel_Kryo_Deserialization
{
    meta:
        description = "Detects Kryo/Java serialization markers and setAlgoMetrics references indicative of CVE-2026-92785 payloads"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92785"
        date = "2026-01-01"
        severity = "high"

    strings:
        $kryo = { AC ED 00 05 }
        $m1 = "setAlgoMetrics" ascii wide
        $m2 = "com.esotericsoftware.kryo" ascii wide
        $m3 = "KryoException" ascii wide
        $j1 = "java.lang.Runtime" ascii wide
        $j2 = "javax.naming" ascii wide
        $j3 = "InvokerTransformer" ascii wide

    condition:
        $kryo and (any of ($m*)) or (2 of ($j*))
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-92785 Angel setAlgoMetrics Kryo Deserialization Attempt"; flow:to_server,established; content:"setAlgoMetrics"; nocase; content:"|AC ED 00 05|"; distance:0; within:512; classtype:attempted-admin; sid:9278501; rev:1; reference:cve,2026-92785; metadata:service angel-rpc, created_at 2026_01_01;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [process where process.name : "java" and process.args : "*angel*"]
  [network where network.direction == "inbound" and destination.port == 21001]
  [file where file.name : "*.log" and file.path : "*/angel/*"]

Splunk SPL Query

index=angel OR index=application sourcetype=angel:master*
( "setAlgoMetrics" OR "KryoException" OR "OutOfMemoryError" OR "ClassNotFoundException" )
| stats count min(_time) as first_seen max(_time) as last_seen by host, src_ip, message
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="angel,cve-2026-92785,">
  <rule id="927851" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">setAlgoMetrics</field>
    <field name="message">KryoException|ClassNotFoundException|OutOfMemoryError|InvalidClassException</field>
    <description>CVE-2026-92785: Angel master Kryo deserialization abuse detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source. Vendor fix: N/A. Known workarounds: N/A.

1. Immediate mitigations (compensating controls):

   • Remove the Angel master RPC endpoint from untrusted networks. Restrict access to the coordinator port via firewall/security-group allowlisting so only known worker/client IPs can connect.
   • Place the coordinator behind authenticated network segmentation (VPN, mTLS proxy, or a service mesh with identity-based admission).
   • Monitor and alert on the detection rules above; unexpected KryoException, ClassNotFoundException, or coordinator OutOfMemoryError events are strong indicators of probing.
   • Apply JVM-level controls where feasible: run the coordinator with a strict security manager / module configuration and a bounded heap so memory-exhaustion attempts fail fast and loudly rather than destabilizing the host.

2. Patch/upgrade steps:

   • No vendor patch is currently available (0/4 confidence). Track the Angel project's releases and advisories for a fix version.
   • When a fix is released, upgrade all master/coordinator nodes first, since they are the exposed deserialization endpoints.
   • If a configuration-based fix becomes available, explicitly enable Kryo class registration requirements and an allowlist covering only legitimate setAlgoMetrics argument classes.

3. Long-term hardening:

   • Enforce RegistrationRequired / allowlist policies on all Kryo deserialization boundaries in the cluster, not just setAlgoMetrics.
   • Add authentication and authorization to the master RPC interface.
   • Implement egress filtering and classpath minimization on coordinator hosts to reduce viable gadget chains.
   • Add automated dependency scanning and track CVE feeds for Angel; verify any third-party "patch" against the upstream project before deploying.

References

• NVD — CVE-2026-92785: https://nvd.nist.gov/vuln/detail/CVE-2026-92785
• CWE-502 — Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (not yet scored at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-92785 NOT listed as of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / in-the-wild exploitation: No public PoC, exploit code, or exploit-in-the-wild evidence is available for CVE-2026-92785. The attack chain in this report is inferred from the vulnerability class (CWE-502) and the NVD description.