Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92785

Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes

CVSS 4.0 9.2 CRITICALCVSS 3.1 8.1 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92785

Published

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92785

Published

angel

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Angel-ML",
                    "product": "angel",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:maven/com.tencent.angel/angel",
                    "versions": [
                        {
                            "version": "0",
                            "lessThanOrEqual": "3.3.0",
                            "status": "affected",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON