Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-119706: LMDeploy lets anyone run commands via /update_weights

CVE-2026-119706 · published 4 days ago

Summary

Versions 0.9.0 through 0.18.0 of LMDeploy can be tricked into executing operating‑system commands when an attacker sends specially crafted data to the /update_weights web address. Because the service does not require authentication for this request, a remote user could take control of the server that runs the LMDeploy API. Upgrade to a version that fixes the problem and restrict network access to the API endpoint to trusted users only.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
internlm	lmdeploy	<= 0.18.0

Original advisory text

LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.

References

https://github.com/InternLM/lmdeploy Product
https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/serve/openai/endpoint... Third Party Advisory
https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/turbomind/turbomind.p... Third Party Advisory
https://github.com/InternLM/lmdeploy/issues/4698 Third Party Advisory
https://github.com/InternLM/lmdeploy/pull/4964 Patch
https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticat... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-1197... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-119706 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.9 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-502Deserialization of Untrusted Data

Timeline

Published30 Oct 2026

Updated31 Oct 2026

First seen30 Oct 2026

Sources

CVE-2026-119706 · NVD

CVE-2026-119706 · MITRE

CVE-2026-119706 · OSV

Track software like this

Free during beta