CVE-2026-92785: Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Angel through 3.3.0 are exposed if an attacker can reach the master RPC endpoint. The vulnerable setAlgoMetrics payload is processed without authentication.
What does an attacker need to exploit this issue?
An attacker needs network access to the master RPC endpoint and must craft a serialized setAlgoMetrics object that Kryo will deserialize. No privileges or user interaction are required, although the attack complexity is rated high.
What can exploitation cause?
A successful attack can instantiate arbitrary classes during Kryo deserialization or exhaust memory on the coordinator. The reported impact includes high confidentiality, integrity, and availability effects.