EUVD-2026-62972
GHSA-q66m-3fcg-jjh7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity pickle RCE in default (no api_keys) config yields PR:N/AC:L/AV:N; arbitrary code execution in the engine gives full C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loads(), and the isinstance check against DistServeCacheFreeRequest runs only after deserialization has already completed. The peer that supplies those bytes is caller-controlled: p2p_connect passes remote_engine_endpoint_info.zmq_address from the request body to connect() on the ZMQ PULL socket, and the POST /distserve/p2p_initialize and /distserve/p2p_connect endpoints in lmdeploy/serve/openai/api_server.py apply no authentication unless the server is started with api_keys, which defaults to None. A remote attacker can direct an engine to pull from a ZMQ endpoint under their control and execute arbitrary code in the engine process. Deployments that do not enable disaggregated serving are not affected, because the receive loop is only started once the migration backend accepts the connection.
AnalysisAI
Unauthenticated remote code execution in InternLM LMDeploy (versions 0.9.2 through 0.15.x) allows a remote attacker to execute arbitrary code inside an inference engine process when disaggregated (P2P) serving is enabled. The disaggregation peer-connector deserializes attacker-influenced ZMQ messages with Python pickle before any type validation, and the /distserve/p2p_initialize and /distserve/p2p_connect endpoints require no authentication in the default configuration (api_keys=None). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target run LMDeploy's disaggregated (P2P) serving mode - the vulnerable handle_zmq_recv receive loop only starts once the migration backend accepts a connection, so single-node/non-disaggregated deployments are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach an internet- or LAN-exposed LMDeploy API server running disaggregated serving without api_keys sends a POST to /distserve/p2p_connect with a request body whose remote_engine_endpoint_info.zmq_address points at a ZMQ endpoint the attacker controls. The victim engine connects its PULL socket and calls recv_pyobj() on the attacker-supplied bytes, and a crafted pickle payload executes arbitrary code in the engine process. … |
| Remediation | Vendor-released patch: upgrade to LMDeploy v0.16.0 or later, which replaces the pickle-based recv_pyobj()/send_pyobj() wire format with JSON plus Pydantic schema validation (commit f05b4ad8bf2e2d84101a1d63b3c44fadd99223b2; release https://github.com/InternLM/lmdeploy/releases/tag/v0.16.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running InternLM LMDeploy versions 0.9.2-0.15.x and disable disaggregated P2P serving on any instance that cannot be immediately patched; restrict network access to inference endpoints to trusted internal networks only as a temporary measure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Request Forgery (SSRF) in InternLM LMDeploy's vision-language module allows remote unauthenticated attackers
A vulnerability was found in InternLM LMDeploy up to 0.7.1. Rated medium severity (CVSS 4.8), this vulnerability is low
A vulnerability was found in InternLM LMDeploy up to 0.7.1. Rated medium severity (CVSS 4.8), this vulnerability is low
Server-side request forgery in InternLM lmdeploy's OpenAI-compatible vision API server lets unauthenticated remote attac
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today