InternLM LMDeploy: Unauthenticated remote code execution via pickle deserialization

Summary

InternLM LMDeploy versions 0.9.0 through 0.18.0 contain an unsafe deserialization flaw in the /update_weights endpoint of the api_server. An unauthenticated remote attacker can send a crafted, base64-encoded pickle in the serialized_named_tensors field, which is loaded without validation and executes operating system commands as the api_server process. The attack requires only network access to the API server, and the default api_server bind is reachable without authentication.

Affected

• InternLM LMDeploy 0.9.0 through 0.18.0
• Default configuration (api_server bound to 0.0.0.0, no api_keys) is exposed

Fixed in

Unknown. No vendor advisory or release naming a fixed version was found. A proposed fix (GitHub PR #4964) was not confirmed as merged or released.

Workaround

• Restrict network access to the api_server port to trusted hosts only; do not expose it to the internet.
• Do not bind to 0.0.0.0 without authentication; set API keys, bind to localhost where possible, and place the service behind an authenticated reverse proxy.
• Verify the pickle-related setting (LMDEPLOY_ALLOW_PICKLE_UPDATE_PARAMS) in your release before relying on it; its behaviour in released code is not verified.
• Note that blocking /update_weights may break clients that use this endpoint, such as XTuner.

Exploitation

• CISA SSVC: Exploitation 'poc', Automatable 'yes', Technical Impact 'total'.
• No evidence of exploitation in the wild found; not checked in the CISA KEV catalog.
• A third-party threat-intel page reports no standalone public exploit was published at the time of writing; this source is weak and unverified.
• Unsafe pickle deserialization is generally easy to exploit once the endpoint is reachable.

Our recommendation

• Treat as urgent if LMDeploy is reachable from untrusted networks.
• Inventory all LMDeploy installations (pip, Docker, GPU servers, developer machines) and record their versions.
• Restrict access to the api_server port and enable authentication now, as no fixed version is confirmed.
• Check api_server hosts for unexpected child processes, new outbound connections and unusual POST requests to /update_weights.
• Update to a fixed release as soon as the vendor publishes one and verify it against the vendor advisory.

Research sources

• CVE record / VulnCheck advisory www.vulncheck.com
• GitHub issue #4698 github.com
• GitHub pull request #4964 github.com
• LMDeploy management.py at v0.18.0 github.com
• LMDeploy releases github.com
• CVE-2026-119706 threat intel mirror cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:24.