CVE-2026-119706: LMDeploy unauthenticated RCE

CISO Take

LMDeploy versions 0.9.0 through 0.18.0 expose an /update_weights endpoint that deserializes attacker-supplied pickle data without authentication, so any network-reachable api_server can be made to run arbitrary OS commands. The CVSS is 9.8 (network, low complexity, no privileges, no user interaction). No public exploit, Nuclei template, KEV listing or EPSS score exists yet, but pickle deserialization RCE is trivial to weaponize and the vendor advisory and source references make the vulnerable code path easy to find. Inventory every LMDeploy deployment, upgrade to a release that includes the fix from pull request 4964, and restrict network access to the api_server to trusted callers until patched. Treat any exposed instance as potentially compromised, since GPU hosts often hold model weights, API keys and cloud credentials.

Sources:NVDATLASvulncheck.comGitHub

What is the risk?

Critical. The flaw is unauthenticated, remotely reachable and gives code execution as the api_server process user (CWE-502). Exploitation requires only a base64-encoded pickle payload in an HTTP request, which is trivial for any attacker. Exposure depends on whether the LMDeploy API server is reachable beyond localhost, which is common in shared inference clusters and quick cloud deployments. Current gaps are the absence of a public exploit, KEV listing or EPSS data, so the likelihood is expected to rise quickly once the advisory is widely read. Downstream dependent counts and package risk data are unavailable (Unknown).

How does the attack unfold?

Initial Access

Attacker locates a network-reachable LMDeploy api_server and sends an unauthenticated request to /update_weights.

AML.T0049

Exploitation

A base64 pickle in serialized_named_tensors is deserialized by ForkingPickler.loads without validation, running attacker commands.

AML.T0050

Post-Exploitation

Attacker harvests model weights, credentials and environment secrets from the inference host.

AML.T0035

Impact

Attacker gains persistent control of the GPU host, tampers with model outputs or pivots deeper into the ML environment.

AML.T0112

Initial Access

Attacker locates a network-reachable LMDeploy api_server and sends an unauthenticated request to /update_weights.

AML.T0049

Exploitation

A base64 pickle in serialized_named_tensors is deserialized by ForkingPickler.loads without validation, running attacker commands.

AML.T0050

Post-Exploitation

Attacker harvests model weights, credentials and environment secrets from the inference host.

AML.T0035

Impact

Attacker gains persistent control of the GPU host, tampers with model outputs or pivots deeper into the ML environment.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LMDeploy	pip	—	No patch
8.1K1 dependentsPushed 7d ago46% patched~18d to patchFull package profile →

Do you use LMDeploy? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

1.0%

chance of exploitation in 30 days

Higher than 64% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade LMDeploy beyond 0.18.0 to a release containing the fix from pull request 4964 and verify the fixed version in the vendor repository. 2) Until patched, block or disable access to the /update_weights endpoint at the reverse proxy, API gateway or WAF, and bind the api_server to localhost or a private network only. 3) Place authentication and network segmentation (mTLS, VPN, allow-lists) in front of all inference management endpoints. 4) Run the service as a non-root user in a hardened container with minimal credentials and restricted egress. 5) Detect: alert on HTTP requests to /update_weights, especially with large base64 serialized_named_tensors fields, and on unexpected child processes (sh, bash, curl, wget, python) spawned by the api_server. 6) If an exposed instance is found, rotate all secrets available to the host and review for persistence.

How is it classified?

Code ExecutionAuth BypassInferenceAPIFrameworkAML.T0035- AI Artifact Collection AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0112- Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and negative impacts

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-119706?

LMDeploy versions 0.9.0 through 0.18.0 expose an /update_weights endpoint that deserializes attacker-supplied pickle data without authentication, so any network-reachable api_server can be made to run arbitrary OS commands. The CVSS is 9.8 (network, low complexity, no privileges, no user interaction). No public exploit, Nuclei template, KEV listing or EPSS score exists yet, but pickle deserialization RCE is trivial to weaponize and the vendor advisory and source references make the vulnerable code path easy to find. Inventory every LMDeploy deployment, upgrade to a release that includes the fix from pull request 4964, and restrict network access to the api_server to trusted callers until patched. Treat any exposed instance as potentially compromised, since GPU hosts often hold model weights, API keys and cloud credentials.

Is CVE-2026-119706 actively exploited?

No confirmed active exploitation of CVE-2026-119706 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-119706?

1) Upgrade LMDeploy beyond 0.18.0 to a release containing the fix from pull request 4964 and verify the fixed version in the vendor repository. 2) Until patched, block or disable access to the /update_weights endpoint at the reverse proxy, API gateway or WAF, and bind the api_server to localhost or a private network only. 3) Place authentication and network segmentation (mTLS, VPN, allow-lists) in front of all inference management endpoints. 4) Run the service as a non-root user in a hardened container with minimal credentials and restricted egress. 5) Detect: alert on HTTP requests to /update_weights, especially with large base64 serialized_named_tensors fields, and on unexpected child processes (sh, bash, curl, wget, python) spawned by the api_server. 6) If an exposed instance is found, rotate all secrets available to the host and review for persistence.

What systems are affected by CVE-2026-119706?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference servers, GPU inference clusters, OpenAI-compatible API gateways.

What is the CVSS score for CVE-2026-119706?

CVE-2026-119706 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 1.03%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference serversGPU inference clustersOpenAI-compatible API gateways

MITRE ATLAS Techniques

AML.T0035AI Artifact Collection

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0112Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.

Exploitation Scenario

An attacker scans for exposed LMDeploy api_server instances, for example through default ports or the OpenAI-compatible API banner. They craft a pickle object whose __reduce__ method runs a reverse shell command, base64-encode it and POST it in the serialized_named_tensors field to /update_weights. ForkingPickler.loads deserializes it, executing the command as the api_server user. The attacker then steals model weights and cloud credentials from the GPU host, installs a miner or backdoor, and pivots into the internal ML environment.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.