Act nowDisclosed

Advisory · CVE-2026-119706

Unauthenticated RCE in LMDeploy via pickle deserialization

LMDeploy 0.9.0 through 0.18.0 lets unauthenticated attackers run OS commands by sending pickled data to the /update_weights endpoint.

Advisory published October 30, 2026Independent summary
Vendor
InternLM
Product
LMDeploy
Identifier / CWE
CVE-2026-119706
CWE-502
Action timing
Immediate
ELI5

Explain it like I’m five

The server accepts a sealed box of instructions from anyone on the network and opens it without checking what is inside. Opening the box runs the instructions as the server itself.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Exposed serving endpoint

    An attacker reaches the LMDeploy api_server /update_weights endpoint without authenticating.

  2. 02Crafted payload

    The attacker sends a base64-encoded crafted pickle in serialized_named_tensors.

  3. 03Unsafe deserialization

    ForkingPickler.loads deserializes the payload without validation.

  4. 04Code execution

    The embedded commands execute as the api_server process.

What happened

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability in the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process. The record rates it critical at CVSS 9.8.

No fixed release is stated in the NVD record or the vendor sources checked for this run, so this advisory claims none. The exposure itself is the urgent fact: any LMDeploy api_server reachable by untrusted clients can be turned into code execution with a single request.

What to do

  1. Inventory LMDeploy api_server deployments, including research, development, and demo instances.
  2. Do not expose the api_server, and especially /update_weights, to untrusted networks; restrict it to trusted hosts only.
  3. Track the vendor fix referenced in pull request 4964 and upgrade to a patched release as soon as the vendor publishes one.
  4. Review api_server logs for /update_weights requests carrying serialized_named_tensors from unexpected sources.
  5. If exploitation cannot be excluded, treat the host as compromised: rebuild it and rotate any credentials or tokens reachable from the api_server process.

Management note

This is an unauthenticated remote code execution flaw in LLM serving infrastructure. Network exposure is the whole attack: restrict who can reach the serving endpoint before the patched release lands, and do not wait for a version number to act.