Horovod versions up to and including 0.28.1 contain a critical vulnerability that allows unauthenticated remote code execution. The flaw arises from insecure deserialization of base64-encoded data in the ElasticRendezvousHandler component, enabling attackers to send malicious pickle objects via PUT requests to execute arbitrary code on the server.