LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
LMDeploy 0.9.0 through 0.18.0 is affected when its api_server is reachable. The server binds to 0.0.0.0 by default, and with no API keys configured no authentication is applied. No fix is listed yet.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Default setups
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: total
Summary
LMDeploy, an open-source toolkit for compressing, deploying, and serving large language models, is affected by this flaw. A remote attacker who can reach its API server without authentication could run arbitrary operating system commands with the privileges of the server process.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: total
- Record last updated
- Posted on X by cve.now
Affected versions
- InternLM lmdeploy
From 0.9.0 · through 0.18.0
References 6
Questions about CVE-2026-119706
What does this mean?
The /update_weights endpoint deserializes the serialized_named_tensors value with Python pickle when it arrives as a string. A crafted request can therefore make the API server process run arbitrary operating system commands without logging in.Source: github.com
Am I affected, and how do I check?
Versions 0.9.0 through 0.18.0 of LMDeploy are in the affected range. Check your installed version with lmdeploy --version or pip show lmdeploy. The default api_server binds to 0.0.0.0, and authentication middleware is only installed when API keys are set, so check the --server-name value and whether API keys are configured.Source: github.com
What should I do about it?
The checked facts list no fixed release, so no upgrade target is available. Check the project's advisory for a patched version before deciding on an upgrade.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data