CVE-2026-119706: LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

Published Oct 30, 2026

Updated

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which ForkingPickler.loads deserializes without validation, executing commands as the apiserver process.

Event History

Oct 30, 2026

CVE Published

via MITRE·03:16 PM

Data Sourced

via MITRE·03:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

LMDeploy versions 0.9.0 through 0.18.0 are affected if the /update_weights endpoint is reachable by an attacker. The issue is in the api_server handling of serialized_named_tensors.

Does exploitation require authentication or user interaction?

No. The vulnerability is unauthenticated and can be exploited remotely with no user interaction or prior privileges.

What does an attacker need to send?

An attacker needs to submit a base64-encoded crafted pickle through serialized_named_tensors to the /update_weights endpoint. Unsafe ForkingPickler.loads deserialization can then execute OS commands as the api_server process.

What is the impact if exploitation succeeds?

Successful exploitation allows execution of operating-system commands with the permissions of the LMDeploy api_server process. This can affect the confidentiality, integrity, and availability of the vulnerable deployment.

CVE-2026-119706: LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What does an attacker need to send?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What does an attacker need to send?

What is the impact if exploitation succeeds?