CVE-2025-66455: LMDeploy DistServe connects to attacker ZeroMQ peers and unpickles their messages, unauthenticated RCE before 0.16.0
LMDeploy 0.9.2 up to 0.16.0, when PD-disaggregation (DistServe) is enabled on the PyTorch backend, lets anyone who can reach the API server pass a ZeroMQ address to POST /distserve/p2p_connect. The engine connects to it and deserializes what it receives with pickle, so a malicious peer runs code in the serving process. Upgrade to 0.16.0. The same bug was also filed by VulnCheck as CVE-2026-76850.
What it is
EngineP2PConnection.handle_zmq_recv() in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer messages with PyZMQ's recv_pyobj(), which is pickle.loads(). The type check runs only after deserialization, when the payload has already executed.
The peer address comes from the request body of POST /distserve/p2p_connect. API-key authentication is off unless the operator sets api_keys, so DistServe deployments without keys allow unauthenticated remote code execution.
Ordinary deployments that do not use disaggregated serving do not expose this path. The fix (commit f05b4ad) replaced the pickle-based ZeroMQ protocol and shipped in 0.16.0. VulnCheck published the same issue as CVE-2026-76850.
How to check
- Run pip show lmdeploy and see whether the version is 0.9.2 or later but below 0.16.0.
- Check whether you run LMDeploy with PD-disaggregation / DistServe, and whether the /distserve/* endpoints are reachable from untrusted networks.
How to fix
- Upgrade to LMDeploy 0.16.0 or later.
- If you can't upgrade yet, keep /distserve/* and the ZeroMQ control plane on a trusted cluster network, set api_keys, and block arbitrary outbound ZeroMQ connections from serving nodes. The advisory notes these steps reduce exposure but don't make pickle safe.
pip show lmdeploy | grep -i ^version
pip install -U 'lmdeploy>=0.16.0'Sources
- criticalCVE-2026-119706: LMDeploy api_server runs attacker pickles sent to /update_weights, unauthenticated RCE in 0.9.0 to 0.18.0, still unfixed
- criticalCVE-2025-59953: LMDeploy's ZeroMQ RPC server unpickles incoming messages, remote code execution in 0.9.1 to 0.10.1
- highCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with url
- highCVE-2026-46432: LMDeploy before 0.13.0 always loads models with trust_remote_code=True, so a malicious model repo runs code