CVE-2026-119706criticalCode execution2026-10-30

CVE-2026-119706: LMDeploy api_server runs attacker pickles sent to /update_weights, unauthenticated RCE in 0.9.0 to 0.18.0, still unfixed

InternLM LMDeploy 0.9.0 through 0.18.0 deserializes base64 pickle data sent to the api_server's /update_weights endpoint without validation, so anyone who can reach the server can run OS commands as the api_server process. The fix pull request (#4964) is still open and 0.18.0 is the latest release, so keep the server off untrusted networks and block that endpoint.

01.

What it is

The POST /update_weights route passes the request's serialized_named_tensors field to the engine, which decodes it and calls ForkingPickler.loads on it. Loading a crafted pickle runs arbitrary Python, so this is remote code execution.

VulnCheck rates it as network-reachable with no login and no user interaction. NVD lists LMDeploy 0.9.0 through 0.18.0 as affected.

The bug report (InternLM/lmdeploy#4698) and the fix PR '[Fix] Reject pickle on HTTP /update_weights' (#4964) were both still open on 11 November 2026.

02.

How to check

Run pip show lmdeploy and see whether the version is between 0.9.0 and 0.18.0.
Check whether your lmdeploy serve api_server port is reachable from anything other than localhost or a trusted internal network.

03.

How to fix

Bind the api_server to localhost or a private network only, and put it behind a reverse proxy that requires authentication.
Block POST requests to /update_weights at the proxy if you don't hot-swap weights over HTTP.
Upgrade as soon as a release that includes the #4964 fix ships.

pip show lmdeploy | grep -i ^version
# keep the server private
lmdeploy serve api_server <model> --server-name 127.0.0.1

04.

Sources

More advisories for this tool