# LMDeploy unauthenticated RCE via pickle in /update_weights (CVE-2026-119706), no fixed release yet · pwn.watch

> InternLM LMDeploy, an open-source toolkit for serving large language models, has an unauthenticated remote code execution flaw in its api_server (CVE-2026-119706, CVSS 4.0 9.3 / CVSS 3.1 9.8 critical). Versions 0.9.0 through 0.18.0 deserialize a base64-encoded pickle sent in serialized_named_tensors to the POST /update_weights endpoint with ForkingPickler.loads and no validation, so anyone who can reach the server can run OS commands as the api_server process. The bug was reported publicly in GitHub issue #4698 in June 2026; the fix pull request #4964, which makes the HTTP endpoint reject pickle by default, is still open and not in any release. The fix PR notes that the default api_server binds to 0.0.0.0 without API keys.

Page: https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706 · generated 2026-10-30T19:26:38.232Z

## Status
- Severity: critical · status: live · patch: unpatched
- Product: InternLM LMDeploy (api_server)
- Started: 2026-10-30
- CVEs: CVE-2026-119706
- Affected: lmdeploy 0.9.0 through 0.18.0 (PyPI), api_server /update_weights endpoint

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706/feed.xml
- JSON Feed: https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706.json
- This file: https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706/llms.txt

## Updates (newest first)
- 2026-10-30: VulnCheck publishes CVE-2026-119706 (CVSS 4.0 9.3 critical): unauthenticated RCE in LMDeploy 0.9.0 through 0.18.0 via pickle in /update_weights. The fix PR #4964 (reject pickle on HTTP /update_weights by default) is still open, so no release contains the fix. (https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticated-rce-via-update-weights-pickle-deserialization)
- 2026-06-22: A GitHub issue reports that LMDeploy /update_weights deserializes request-controlled pickle data before validation. (https://github.com/InternLM/lmdeploy/issues/4698)

## Fix brief
# Security brief: LMDeploy unauthenticated RCE via pickle in /update_weights (CVE-2026-119706), no fixed release yet

Source: https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706 · status: live · severity: critical · updated Oct 30, 2026, 16:45 UTC

## Patch status
**UNPATCHED: no fixed release yet. Apply mitigations and watch for updates.**

## What it is
InternLM LMDeploy, an open-source toolkit for serving large language models, has an unauthenticated remote code execution flaw in its api_server (CVE-2026-119706, CVSS 4.0 9.3 / CVSS 3.1 9.8 critical). Versions 0.9.0 through 0.18.0 deserialize a base64-encoded pickle sent in serialized_named_tensors to the POST /update_weights endpoint with ForkingPickler.loads and no validation, so anyone who can reach the server can run OS commands as the api_server process. The bug was reported publicly in GitHub issue #4698 in June 2026; the fix pull request #4964, which makes the HTTP endpoint reject pickle by default, is still open and not in any release. The fix PR notes that the default api_server binds to 0.0.0.0 without API keys.

Severity detail: CVSS 4.0 9.3 and CVSS 3.1 9.8 (network, no auth, low complexity); no fixed release yet and the default server bind is all interfaces without API keys, per the fix PR

- Product: InternLM LMDeploy (api_server)
- CVE / advisory ids: CVE-2026-119706

## Affected versions
- lmdeploy 0.9.0 through 0.18.0 (PyPI), api_server /update_weights endpoint

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Mitigations
The data marks this as unpatched. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows).

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
If you run lmdeploy serve api_server (0.9.0 to 0.18.0), do not expose it to untrusted networks: bind it to 127.0.0.1 or a private interface, put it behind a firewall or authenticating reverse proxy, set --api-keys, and block POST /update_weights at the proxy if you do not use it. Watch for a release that includes PR #4964 and upgrade then. Re-check the PR and lmdeploy releases; set patchStatus to patched when a fixed version ships.

## Latest updates
- Oct 30, 2026: VulnCheck publishes CVE-2026-119706 (CVSS 4.0 9.3 critical): unauthenticated RCE in LMDeploy 0.9.0 through 0.18.0 via pickle in /update_weights. The fix PR #4964 (reject pickle on HTTP /update_weights by default) is still open, so no release contains the fix.
- Jun 22, 2026: A GitHub issue reports that LMDeploy /update_weights deserializes request-controlled pickle data before validation.

## Advisories
- [LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization](https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticated-rce-via-update-weights-pickle-deserialization) (VulnCheck)
- [CVE-2026-119706](https://nvd.nist.gov/vuln/detail/CVE-2026-119706) (NVD)

## Write-ups & news
- [[Fix] Reject pickle on HTTP /update_weights (PR #4964, open)](https://github.com/InternLM/lmdeploy/pull/4964)
- [[Bug] /update_weights deserializes request-controlled pickle data before validation (issue #4698)](https://github.com/InternLM/lmdeploy/issues/4698)

---
Machine-readable: https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.