CVE-2026-92785 Details

A vulnerability exists in Angel versions through 3.3.0, where the application deserializes untrusted payloads in the 'setAlgoMetrics' RPC method using Kryo serialization. This process lacks proper class registration and allowlist validation, enabling unauthenticated network attackers to instantiate arbitrary classes with controlled field values. Additionally, attackers can exploit this vulnerability to cause a denial-of-service by sending crafted serialized objects that exhaust the coordinator's memory. The issue arises because the deserialization process can be manipulated to allocate large amounts of memory, leading to an out-of-memory error and crashing the coordinator process.

It is recommended to require authentication for 'PSAgentMasterService' RPC calls and to validate the 'setAlgoMetrics' payload by implementing a class allowlist. Additionally, setting a maximum size limit for deserialized objects can prevent excessive memory allocation.