ShadowMQ — critical RCE in Meta/NVIDIA/vLLM inference servers via pickle deserialization
Date: 2025-11
Affected: Meta, NVIDIA, vLLM inference servers
Attack vector: deserialization
Category: research-demonstrated
Severity: Critical
CVE: CVE-2024-50050
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

Critical RCE vulnerabilities in AI inference servers from unsafe ZeroMQ pickle deserialization via code reuse across Meta, NVIDIA, and vLLM. CVE-2024-50050. Allows cluster takeover and data theft.

Impact: Cluster compromise; full system control; data exfiltration

Mitigations:
Audit code reuse for inherited vulnerabilities
Input validation on inter-process communication
Replace pickle with safe serialization (protobuf, msgpack)

Architectural layers (MAESTRO):
label: Deployment & Infrastructure
notes: Unsafe pickle deserialization in inference server communication
role: origin
label: Agent Ecosystem
notes: Vulnerability spread via code reuse across major AI vendors
role: propagation