LMDeploy CVE-2026-119706

Requires a reachable LMDeploy api_server running an affected version (0.9.0-0.18.0) that exposes the /update_weights management endpoint, which in these versions accepts and pickle-deserializes HTTP bodies by default with no authentication (PR:N confirmed by vector). The attacker needs only network access to that endpoint and the ability to POST a base64-encoded pickle in serialized_named_tensors; no user interaction or credentials are needed. Limiting factors: the api_server and its /update_weights endpoint must be network-reachable (these are typically internal RL-training/weight-update deployments rather than public services), and the fixed releases close the default path - post-patch, pickle handling is disabled unless the operator explicitly sets LMDEPLOY_ALLOW_PICKLE_UPDATE_PARAMS=1 on the server.

All severity signals align toward high real-world risk. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a fully remote, low-complexity, unauthenticated attack with high confidentiality, integrity and availability impact, and the vuln.today Decision label is act_now. The underlying flaw is CWE-502 (untrusted pickle deserialization), confirmed by the PR #4964 source diff showing ForkingPickler.loads being called on an attacker-supplied base64 payload - this is one of the most reliable RCE primitives in Python, so the AC:L rating is well supported. Exploitation status is 'no public exploit identified at time of analysis': the input shows no KEV listing and no confirmed POC flag, only a VulnCheck advisory and a vendor issue/PR. No EPSS score was provided, so statistical exploitation probability cannot be quantified here. The main factor moderating raw severity is exposure: LMDeploy api_server instances are typically internal RL-training/inference endpoints, so widespread internet-facing exposure is not established by the data. Net: treat as a genuine high priority (act_now) given a confirmed, patched, unauthenticated deserialization RCE mechanism, not merely a high-CVSS-but-low-risk issue - but note KEV=NO means active exploitation is not confirmed.

A remote, unauthenticated attacker reaches an LMDeploy api_server (version 0.9.0-0.18.0) exposing the /update_weights endpoint and sends an HTTP POST containing a base64-encoded malicious pickle in the serialized_named_tensors field. ForkingPickler.loads deserializes it without validation, executing arbitrary OS commands with the privileges of the api_server process. No public working exploit is confirmed in the input, though a VulnCheck advisory describes the flaw.