{"id":"CVE-2024-10190","kind":"vulnerability","aliases":["CVE-2024-10190","GHSA-mrhh-3ggq-23p2"],"related":[],"title":"Horovod Vulnerable to Command Injection","description":"Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.","summary":"Horovod up to and including 0.28.1 lets anyone send a PUT request to the elastic rendezvous handler carrying a malicious base64 pickle object. The server deserializes it with cloudpickle, so the attacker runs arbitrary code on the server.","severity":"critical","cvss":9.8,"epss":0.01124,"exploited":false,"exploited_at":null,"products":[{"name":"horovod","fixed":[],"affected":"<= 0.28.1","ecosystem":"pypi"},{"name":"horovod","fixed":[],"affected":"<= 0.28.1","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-502","cwe-77","horovod","ml-training","package","python","self-hosted"],"not_affected_if":["no-network-exposure","not-elastic-mode"],"how_to_check":"- Run `pip show horovod` and compare the version against `0.28.1`.\n- Check whether the elastic rendezvous server (ElasticRendezvousHandler) is running in the training cluster; the sources do not say which default setups start it.","fix":"- Upgrade horovod past `0.28.1`; the sources do not name the fixed version.\n- Until patched, keep the rendezvous HTTP port off untrusted networks.","status":"open","published_at":"2025-03-20T10:15:15+00:00","first_seen_at":"2026-10-27T17:27:30+00:00","triaged_at":"2026-10-27T17:27:57+00:00","updated_at":"2026-10-27T17:32:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T17:27:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade horovod past `0.28.1`; the sources do not name the fixed version.\n- Until patched, keep the rendezvous HTTP port off untrusted networks.","reach":"network","title":"Horovod: unauthenticated PUT request runs code via pickle deserialization","impact":"high","summary":"Horovod up to and including 0.28.1 lets anyone send a PUT request to the elastic rendezvous handler carrying a malicious base64 pickle object. The server deserializes it with cloudpickle, so the attacker runs arbitrary code on the server.","category":"package","nicknames":[],"who_cares":["python","horovod","ml-training","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code on the training server","analyst_note":"Confirm the fixed version and whether the elastic rendezvous server is on by default, using https://github.com/advisories/GHSA-mrhh-3ggq-23p2.","how_to_check":"- Run `pip show horovod` and compare the version against `0.28.1`.\n- Check whether the elastic rendezvous server (ElasticRendezvousHandler) is running in the training cluster; the sources do not say which default setups start it.","needs_analyst":true,"not_affected_if":["no-network-exposure","not-elastic-mode"],"who_is_affected":"Teams running Horovod elastic training with the rendezvous KV store exposed on a reachable network are affected, since the PUT path needs no login. Systems that only use Horovod on a closed machine or network without the elastic rendezvous server are less exposed; the sources do not say whether that server runs by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000652,"input_tokens":3453,"output_tokens":613,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-10190':8A,16A '-2024':7A,15A '-502':20B '-77':22B '0.28.1':37B '23p2':13A '3ggq':12A 'allow':120C 'anyon':39B 'arbitrari':65B,135C 'attack':63B,122C 'base64':52B,93C,112C 'base64-encoded':92C 'call':110C 'carri':49B 'cloudpickl':60B 'cloudpickle.loads':117C 'code':66B,82C,136C 'codec.loads':111C 'command':4A 'cve':6A,14A 'cwe':19B,21B 'data':95C 'decod':118C 'deseri':57B 'due':87C 'elast':46B 'elasticrendezvoushandl':98C,109C 'encod':94C 'eventu':115C 'execut':83C,137C 'ghsa':10A 'ghsa-mrhh-3ggq-23p2':9A 'handl':90C 'handler':48B 'horovod':1A,17A,18A,23B,32B,70C 'host':31B 'improp':89C 'includ':36B,75C 'inject':5A 'invok':116C 'kvstorehandl':102C 'lead':133C 'let':38B 'malici':51B,126C 'method':107C 'ml':25B 'ml-train':24B 'mrhh':11A 'object':54B,128C 'packag':27B 'pickl':53B,127C 'put':42B,105C,131C 'python':28B 'remot':81C 'rendezv':47B 'request':43B,132C 'run':64B 'self':30B 'self-host':29B 'send':40B,124C 'server':56B,69B,140C 'specif':103C 'subclass':100C 'train':26B 'unauthent':80C 'v0.28.1':76C 'valu':106C,113C 'version':71C 'via':129C 'vulner':2A,78C,85C","nicknames":[],"mitigations":[],"who_affected":"Teams running Horovod elastic training with the rendezvous KV store exposed on a reachable network are affected, since the PUT path needs no login. Systems that only use Horovod on a closed machine or network without the elastic rendezvous server are less exposed; the sources do not say whether that server runs by default.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-20T10:15:15+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-mrhh-3ggq-23p2","url":"https://github.com/advisories/GHSA-mrhh-3ggq-23p2","severity":"critical","published_at":"2025-03-20T12:32:38+00:00","modified_at":"2026-10-27T17:24:06+00:00","first_seen_at":"2026-10-27T17:27:30+00:00","fetched_at":"2026-10-27T17:27:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-10190","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10190","severity":null,"published_at":"2025-03-20T10:15:15+00:00","modified_at":"2026-06-17T06:55:07+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","fetched_at":"2026-10-27T17:32:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}