CVE-2026-92971: LMDeploy unauthenticated assertion

CISO Take

LMDeploy through 0.17.0 has a reachable assertion in its DistServe decode migration loop. An unauthenticated attacker can send a single migration_request with an empty remote_block_ids list, which raises an AssertionError, kills the engine loop, and makes every later inference request fail. The CVSS is 7.5 (network, low complexity, no privileges, availability impact only). Urgency is moderate: EPSS is 0.7% (48th percentile), the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC says TRACK*. The trigger is trivial, though, so any internet-reachable or loosely segmented LMDeploy deployment using DistServe/PD-disaggregation is exposed to a one-request outage. Check whether any LMDeploy endpoints are exposed, put authentication or network restrictions in front of them, and upgrade to a fixed release once the maintainers publish one (see upstream issue #4965). Confidentiality and integrity are not affected.

Sources:NVDEPSSATLASVulnCheck advisoryGitHub (InternLM/lmdeploy)CISA SSVC

What is the risk?

Medium-High. Availability-only impact, but exploitation takes a single unauthenticated HTTP request with no AI/ML knowledge. Real-world likelihood is low to moderate (EPSS 0.7%, no known exploit, not in KEV). Exposure depends on whether the OpenAI-compatible API server is reachable by untrusted parties and whether DistServe/migration features are enabled. Inference services without a gateway or authentication are the most at risk. The engine does not recover on its own, so the outage persists until the process is restarted.

How does the attack unfold?

Initial Access

Attacker reaches an exposed LMDeploy API endpoint with no authentication required.

AML.T0049

Exploitation

Attacker submits a migration_request with an empty remote_block_ids list, triggering an AssertionError in the DistServe decode migration loop.

AML.T0040

Impact

The engine loop crashes and all subsequent inference requests fail until the service is manually restarted.

AML.T0029

Initial Access

Attacker reaches an exposed LMDeploy API endpoint with no authentication required.

AML.T0049

Exploitation

Attacker submits a migration_request with an empty remote_block_ids list, triggering an AssertionError in the DistServe decode migration loop.

AML.T0040

Impact

The engine loop crashes and all subsequent inference requests fail until the service is manually restarted.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LMDeploy	pip	—	No patch
8.1K1 dependentsPushed 6d ago46% patched~18d to patchFull package profile →

Do you use LMDeploy? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade LMDeploy to a release newer than 0.17.0 that fixes the validation (track https://github.com/InternLM/lmdeploy/issues/4965); if no fixed release exists, apply the upstream patch or add validation that rejects migration_request payloads with empty remote_block_ids. 2) Do not expose LMDeploy API servers directly to the internet; place them behind an authenticating reverse proxy or API gateway and restrict migration/DistServe endpoints to internal prefill/decode nodes (network policy, mTLS, or firewall). 3) Add a process supervisor (systemd, Kubernetes liveness/readiness probes) so a crashed engine loop triggers an automatic restart. 4) Detection: alert on AssertionError traces from engine_loop.py, sudden 5xx spikes or hung requests after a /v1/completions call, and POST bodies containing an empty remote_block_ids array or migration_request fields from untrusted sources. 5) Inventory LMDeploy versions across clusters with an SBOM or pip freeze scan.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSInferenceAPIAML.T0029- Denial of AI Service AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from unknown risks and incidents

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-92971?

LMDeploy through 0.17.0 has a reachable assertion in its DistServe decode migration loop. An unauthenticated attacker can send a single migration_request with an empty remote_block_ids list, which raises an AssertionError, kills the engine loop, and makes every later inference request fail. The CVSS is 7.5 (network, low complexity, no privileges, availability impact only). Urgency is moderate: EPSS is 0.7% (48th percentile), the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC says TRACK*. The trigger is trivial, though, so any internet-reachable or loosely segmented LMDeploy deployment using DistServe/PD-disaggregation is exposed to a one-request outage. Check whether any LMDeploy endpoints are exposed, put authentication or network restrictions in front of them, and upgrade to a fixed release once the maintainers publish one (see upstream issue #4965). Confidentiality and integrity are not affected.

Is CVE-2026-92971 actively exploited?

No confirmed active exploitation of CVE-2026-92971 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-92971?

1) Upgrade LMDeploy to a release newer than 0.17.0 that fixes the validation (track https://github.com/InternLM/lmdeploy/issues/4965); if no fixed release exists, apply the upstream patch or add validation that rejects migration_request payloads with empty remote_block_ids. 2) Do not expose LMDeploy API servers directly to the internet; place them behind an authenticating reverse proxy or API gateway and restrict migration/DistServe endpoints to internal prefill/decode nodes (network policy, mTLS, or firewall). 3) Add a process supervisor (systemd, Kubernetes liveness/readiness probes) so a crashed engine loop triggers an automatic restart. 4) Detection: alert on AssertionError traces from engine_loop.py, sudden 5xx spikes or hung requests after a /v1/completions call, and POST bodies containing an empty remote_block_ids array or migration_request fields from untrusted sources. 5) Inventory LMDeploy versions across clusters with an SBOM or pip freeze scan.

What systems are affected by CVE-2026-92971?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference engines, disaggregated prefill/decode (DistServe) deployments, OpenAI-compatible API gateways, RAG pipelines, agent frameworks.

What is the CVSS score for CVE-2026-92971?

CVE-2026-92971 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.70%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference enginesdisaggregated prefill/decode (DistServe) deploymentsOpenAI-compatible API gatewaysRAG pipelinesagent frameworks

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migration_request with an empty remote_block_ids list to trigger an AssertionError that crashes the engine loop and causes subsequent inference requests to fail.

Exploitation Scenario

An attacker finds an exposed LMDeploy OpenAI-compatible endpoint, for example through internet scanning or a misconfigured ingress. They send a completions request that includes a migration_request with remote_block_ids set to an empty list. The decode migration loop hits the assertion, the engine loop terminates, and all later inference calls fail. The attacker can repeat the request after each restart to keep the service down, disrupting customer-facing AI features or internal copilots with no credentials and no heavy traffic.

Weaknesses (CWE)

CWE-617Reachable Assertion CWE-617Reachable Assertion

CWE-617 — Reachable Assertion: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

[Implementation] If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
[Implementation] Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.

Source: MITRE CWE corpus.