CVE-2026-49121 is a high severity remote code execution flaw (CVSS 8.1) in AI Tensor Engine for ROCm (AITER) through 0.1.14. MessageQueue.recv() loads pickle data from an unauthenticated ZMQ socket. We could not confirm a fixed version, so isolate the cluster network and watch the upstream issue.
What's affected
AITER through 0.1.14. The VulnCheck advisory says the affected version range remains undefined, and the upstream issue 3076 was open when the project's May 2026 newsletter listed it as a known issue. We could not confirm a fixed release.
The flaw sits in the distributed message queue that connects inference workers. Attackers who can reach the writer's endpoint on the cluster network, or supply a forged handle, could send data that runs on each remote reader worker.
How to check if you're exposed
Check the installed package and where multi node inference runs.
pip list | grep -i aiter
pip show amd-aiter
The second package name may differ in your setup. Then map which hosts can reach the ZMQ ports opened by the distributed workers, and whether any untrusted system shares that network.
What to do now
- Find every inference deployment that uses AITER, including vLLM and SGLang setups that may pull it in.
- Check the upstream issue for ROCm/aiter 3076 and the project releases for a fix before you upgrade.
- Put worker to worker traffic on an isolated, private network segment, and block outside access to the ZMQ ports.
- Run workers with minimal rights and no cloud credentials beyond what inference needs.
Why it matters
The class is CWE-502, deserialization of untrusted data. Python's pickle format can run code when loaded, so reading pickle bytes from a network socket without authentication gives the sender control of the receiving process. The advisory says there is no authentication, signature check or format validation on that socket.
The attack complexity is rated high, because the attacker needs network reach to the cluster or a forged handle. That points to the right response for any multi node ML system: treat the interconnect as a trust boundary. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
Paste your lockfile or manifest into the free in-browser dependency scan to see whether AITER is in your tree, including as a transitive dependency. Reachability analysis can then show whether your code calls the affected path, which helps you order the work.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Should I wait for a patch before acting?
No. Network isolation is available now and removes most of the exposure.
Sources
Last reviewed: 19 October 2026.
