CVE-2026-90614
Received Received - Intake

Deserialization Flaw in FedML MQTT+S3 Backend

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.read_model of the file fedml/core/distributed/communication/s3/remote_storage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3_key_str causes deserialization. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90614
EUVD
EUVD-2026-77169

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fedml-ai fedml to 0.9.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in FedML-AI FedML up to version 0.9.6. It involves the function S3Storage.read_model in the file fedml/core/distributed/communication/s3/remote_storage.py. The issue allows manipulation of the s3_key_str argument, leading to deserialization. This can be exploited remotely through the MQTT+S3 Communication Backend.

Detection Guidance

Check FedML versions installed on your system. If using version 0.9.6 or earlier, inspect the file fedml/core/distributed/communication/s3/remote_storage.py for the function S3Storage.read_model. Look for deserialization of the s3_key_str argument. Monitor network traffic for unusual MQTT+S3 communication patterns.

Impact Analysis

An attacker could exploit this to execute arbitrary code or access sensitive data due to unsafe deserialization. This may lead to data breaches, unauthorized system access, or disruption of federated learning operations if the MQTT+S3 backend is used.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, reputational damage, and loss of user trust.

Mitigation Strategies

Upgrade FedML to a version beyond 0.9.6 if available. If no patch exists, disable the MQTT+S3 Communication Backend component. Restrict network access to S3 storage endpoints. Review and audit all S3 key handling logic in the affected file.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90614. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart