---
id: "CVE-2024-10190"
kind: "vulnerability"
aliases: ["CVE-2024-10190", "GHSA-mrhh-3ggq-23p2"]
title: "Horovod Vulnerable to Command Injection"
severity: "critical"
cvss: 9.8
epss: 0.01124
exploited: false
status: "open"
category: "package"
products: [{"name": "horovod", "fixed": [], "affected": "<= 0.28.1", "ecosystem": "pypi"}, {"name": "horovod", "fixed": [], "affected": "<= 0.28.1", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["cwe-502", "cwe-77", "horovod", "ml-training", "package", "python", "self-hosted"]
not_affected_if: ["no-network-exposure", "not-elastic-mode"]
published_at: "2025-03-20T10:15:15+00:00"
first_seen_at: "2026-10-27T17:27:30+00:00"
updated_at: "2026-10-27T17:32:47+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-mrhh-3ggq-23p2", "first_seen_at": "2026-10-27T17:27:30+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10190", "first_seen_at": "2026-10-27T17:32:47+00:00"}]
---

# Horovod Vulnerable to Command Injection

Horovod up to and including 0.28.1 lets anyone send a PUT request to the elastic rendezvous handler carrying a malicious base64 pickle object. The server deserializes it with cloudpickle, so the attacker runs arbitrary code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:horovod affected <= 0.28.1 fixed ?
- vendor:horovod affected <= 0.28.1 fixed ?

## How to check

- Run `pip show horovod` and compare the version against `0.28.1`.
- Check whether the elastic rendezvous server (ElasticRendezvousHandler) is running in the training cluster; the sources do not say which default setups start it.

## Fix

- Upgrade horovod past `0.28.1`; the sources do not name the fixed version.
- Until patched, keep the rendezvous HTTP port off untrusted networks.

## Timeline

- 2026-10-27T17:27:30+00:00 ghsa https://github.com/advisories/GHSA-mrhh-3ggq-23p2
- 2026-10-27T17:32:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-10190

## From the sources

Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_