CVE-2019-16328: RPyC - Dynamic modification of RPyC service due to missing security check
Summary
CVE-2019-16328: Dynamic modification of RPyC service due to missing security check. Affects rpyc versions >= 4.1.0, < 4.1.1. Fixed in 4.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RPyC is a powerful yet lightweight library for remote procedure calls between Python processes. It provides a transparent and efficient way to invoke methods on remote objects, making it easy to build distributed systems. However, version 4.1.0 of RPyC is vulnerable to a security issue that allows for dynamic modification of RPyC services without proper security checks.
Vulnerability Detail
The vulnerability in RPyC version 4.1.0 affects custom RPyC services, making them susceptible to authenticated remote attacks. This vulnerability allows an attacker to modify the behavior of the RPyC service by bypassing security checks. This can lead to unauthorized access, data leakage, or even remote code execution. The vulnerability was identified in Git commits between September 2018 and October 2019.
How To Fix
Latest published version: 6.0.2 as of 22 Oct 2026
pip install --upgrade "rpyc==6.0.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.1
This is the first release that contains the fix.
pip install --upgrade "rpyc==4.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a newer version of RPyC is not immediately feasible, a temporary workaround can be applied. The commit d818ecc83a92548994db75a0e9c419c7bce680d6 can be used as a patch to add the missing access check. Applying this patch will mitigate the vulnerability until a proper upgrade can be performed.
Conclusion
The vulnerability in RPyC version 4.1.0 allows for dynamic modification of RPyC services without proper security checks. To fix this vulnerability, it is recommended to upgrade to a version of RPyC that includes the necessary security checks, such as version 4.1.1 or later. If immediate upgrade is not possible, a temporary workaround using the provided patch can be applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rpyc →
FAQ
RPyC is a library for remote procedure calls between Python processes. It provides a transparent and efficient way to invoke methods on remote objects, making it easy to build distributed systems.
The vulnerability allows for dynamic modification of RPyC services, which can lead to unauthorized access, data leakage, or remote code execution. It is important to patch this vulnerability to prevent potential attacks.
The vulnerability affects version 4.1.0 of RPyC. It is recommended to upgrade to version 4.1.1 or later to fix the vulnerability.
To apply the temporary workaround, use the commit d818ecc83a92548994db75a0e9c419c7bce680d6 as a patch to add the missing access check. This will mitigate the vulnerability until a proper upgrade can be performed.
For more information about this vulnerability, you can open an issue on the GitHub repository of RPyC: https://github.com/tomerfiliba-org/rpyc
Related vulnerabilities
Recent vulnerabilities recorded for rpyc.
