Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-76850: LMDeploy Disaggregated Serving Exposes Remote Code Execution Risk
CVE-2026-76850 · published 2 months ago
Summary
LMDeploy's disaggregated serving feature allows a malicious peer to inject code that can be executed by the server, potentially leading to unauthorized access or data tampering. This risk is mitigated when disaggregated serving is disabled. To minimize this risk, consider enabling authentication for the API endpoints used in disaggregated serving.
What to do
- Update internlm lmdeploy to version 0.16.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| internlm | lmdeploy | < 0.16.0 |
Original advisory text
LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector
LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loads(), and the isinstance check against DistServeCacheFreeRequest runs only after deserialization has already completed. The peer that supplies those bytes is caller-controlled: p2p_connect passes remote_engine_endpoint_info.zmq_address from the request body to connect() on the ZMQ PULL socket, and the POST /distserve/p2p_initialize and /distserve/p2p_connect endpoints in lmdeploy/serve/openai/api_server.py apply no authentication unless the server is started with api_keys, which defaults to None. A remote attacker can direct an engine to pull from a ZMQ endpoint under their control and execute arbitrary code in the engine process. Deployments that do not enable disaggregated serving are not affected, because the receive loop is only started once the migration backend accepts the connection.
References
- https://github.com/InternLM/lmdeploy/commit/f05b4ad8bf2e2d84101a1d63b3c44fadd992... Patch
- https://github.com/InternLM/lmdeploy Product
- https://github.com/InternLM/lmdeploy/blob/v0.15.0/lmdeploy/pytorch/disagg/conn/e... Third Party Advisory
- https://github.com/InternLM/lmdeploy/releases/tag/v0.16.0 Vendor Advisory
- https://www.vulncheck.com/advisories/lmdeploy-remote-code-execution-via-unsafe-p... Vendor Advisory
- https://github.com/InternLM/lmdeploy/issues/4804 Third Party Advisory
- https://pypi.org URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76850... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-76850 Vendor Advisory
- https://github.com/InternLM/lmdeploy/blob/v0.15.0/lmdeploy/pytorch/disagg/conn/e... Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published19 Aug 2026
Updated31 Oct 2026
First seen19 Aug 2026
Track software like this
Free during beta