CVE-2026-76850

Received Received - Intake

LMDeploy Arbitrary Code Execution via Pickle Deserialization

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loads(), and the isinstance check against DistServeCacheFreeRequest runs only after deserialization has already completed. The peer that supplies those bytes is caller-controlled: p2p_connect passes remote_engine_endpoint_info.zmq_address from the request body to connect() on the ZMQ PULL socket, and the POST /distserve/p2p_initialize and /distserve/p2p_connect endpoints in lmdeploy/serve/openai/api_server.py apply no authentication unless the server is started with api_keys, which defaults to None. A remote attacker can direct an engine to pull from a ZMQ endpoint under their control and execute arbitrary code in the engine process. Deployments that do not enable disaggregated serving are not affected, because the receive loop is only started once the migration backend accepts the connection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76850

EUVD

EUVD-2026-62972

Affected Vendors & Products

Vendor	Product	Version / Range
lmdeploy	lmdeploy	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability involves LMDeploy deserializing peer messages using pickle without proper validation. The handle_zmq_recv function reads cache-free requests via recv_pyobj(), which deserializes data with pickle.loads(). The check for DistServeCacheFreeRequest occurs only after deserialization, allowing an attacker to send malicious payloads via a controlled ZMQ endpoint. If the server lacks authentication, the attacker can execute arbitrary code in the engine process.

Impact Analysis

An attacker could exploit this to run arbitrary code on your LMDeploy engine, potentially taking control of the system, stealing data, or disrupting services. Deployments without disaggregated serving enabled are not affected.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or loss of sensitive information. This may violate GDPR's data protection requirements or HIPAA's security rules, depending on the data processed.

Mitigation Strategies

Disable disaggregated serving if not in use. Ensure API endpoints /distserve/p2p_initialize and /distserve/p2p_connect require authentication by setting api_keys during server startup. Block unauthorized ZMQ endpoints in network firewalls.

Hi! I’m here to help you understand CVE-2026-76850. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70