Llm Inference
Security incidents tagged Llm Inference. Newest first.
2 Llm Inference incidents in the last 12 months
- Incidents
- 2
- Live
- 2
- Patched
- 1
- Days without an incident
- 0
- Longest quiet run: 51 days (Jul 7–Aug 26)
- CriticalNo patch yet
LMDeploy unauthenticated RCE via pickle in /update_weights (CVE-2026-119706), no fixed release yet
InternLM LMDeploy, an open-source toolkit for serving large language models, has an unauthenticated remote code execution flaw in its api_server (CVE-2026-119706, CVSS 4.0 9.3 / CVSS 3.1 9.8 critical). Versions 0.9.0 through 0.18.0 deserialize a base64-encoded pickle sent in serialized_named_tensors to the POST /update_weights endpoint with ForkingPickler.loads and no validation, so anyone who can reach the server can run OS commands as the api_server process. The bug was reported publicly in GitHub issue #4698 in June 2026; the fix pull request #4964, which makes the HTTP endpoint reject pickle by default, is still open and not in any release. The fix PR notes that the default api_server binds to 0.0.0.0 without API keys.
InternLM LMDeploy (api_server)Since Oct 30, 2026
Show 1 older incident1 older incident
August 2026 1
- Patched
Cloudflare Workers AI's GLM-5.3 returned other customers' data in 155 responses after an SGLang KV cache bug; SGLang operators should update to v0.5.22
Between Aug 27 and Sep 9 2026, Cloudflare's GLM-5.3 model on Workers AI (@cf/zai-org/glm-5.3) sometimes answered very long prompts with data from other customers' recent requests to the same model, Cloudflare disclosed on Oct 26. 155 responses were affected, all to prompts longer than 681,280 tokens. Two issues combined: Cloudflare launched the model with a 1,048,576-token context window but a prefill KV cache pool that held only 681,280 tokens, and SGLang, the open-source inference engine it uses, mishandled over-length requests in disaggregated prefill/decode mode. Instead of returning an error, it swapped the prompt for a one-token placeholder, transferred one KV page, and let the decode node attend over stale cache pages still holding earlier users' prompts and partial generations, returning HTTP 200. Researcher Gadi Evron of Knostic reported it via HackerOne on Sep 8; Cloudflare took the model offline on Sep 9, fixed its configuration and engine, and restored it the same day. It found no evidence of deliberate exploitation and says no other Workers AI model was affected, so Cloudflare customers have nothing to do. Anyone running SGLang in disaggregated prefill/decode mode should update to v0.5.22 or later (or backport #36988 and #38935) and check that each node's KV pool is at least as large as the context length.
SGLang inference engine (disaggregated prefill/decode mode); Cloudflare Workers AI GLM-5.3 modelSince Aug 27, 2026
