LMDeploy unauthenticated RCE via pickle in /update_weights (CVE-2026-119706), no fixed release yet
InternLM LMDeploy (api_server)
InternLM LMDeploy, an open-source toolkit for serving large language models, has an unauthenticated remote code execution flaw in its api_server (CVE-2026-119706, CVSS 4.0 9.3 / CVSS 3.1 9.8 critical). Versions 0.9.0 through 0.18.0 deserialize a base64-encoded pickle sent in serialized_named_tensors to the POST /update_weights endpoint with ForkingPickler.loads and no validation, so anyone who can reach the server can run OS commands as the api_server process. The bug was reported publicly in GitHub issue #4698 in June 2026; the fix pull request #4964, which makes the HTTP endpoint reject pickle by default, is still open and not in any release. The fix PR notes that the default api_server binds to 0.0.0.0 without API keys.
Why this severity: CVSS 4.0 9.3 and CVSS 3.1 9.8 (network, no auth, low complexity); no fixed release yet and the default server bind is all interfaces without API keys, per the fix PR
- Started
- Oct 30, 2026
Affected
- lmdeploy 0.9.0 through 0.18.0 (PyPI), api_server /update_weights endpoint
Fixed in
No fixed release yet
Timeline2
VulnCheck publishes CVE-2026-119706 (CVSS 4.0 9.3 critical): unauthenticated RCE in LMDeploy 0.9.0 through 0.18.0 via pickle in /update_weights. The fix PR #4964 (reject pickle on HTTP /update_weights by default) is still open, so no release contains the fix.
A GitHub issue reports that LMDeploy /update_weights deserializes request-controlled pickle data before validation.
Advisories2
News & write-ups2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
