External risk intelligence

InternLM LMDeploy Unauthenticated Remote Code Execution via Pickle Deserialization

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-119706

The vulnerability exists in an API endpoint (/update_weights) of a machine learning model serving framework. Such services are commonly deployed as web APIs or backend services intended to be reachable by authorized clients or integrated into larger web-facing applications, making the endpoint potentially exposed to network-based access.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in InternLM's LMDeploy technology, specifically within its weight update function. This issue allows unauthenticated remote attackers to execute operating system commands by sending specially crafted data. The primary concern is to confirm if this technology is used within the organization and if so, to what extent it might be exposed.

Unauthenticated attackers can run commands remotely.
Confirm relevance and exposure of this technology.
Understand potential impact on deployed systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted, pickled data over the network to the `/update_weights` endpoint of InternLM LMDeploy. This endpoint is designed to accept serialized tensors for updating model weights but lacks proper validation of the incoming data. When the system deserializes this malicious pickle, it can be tricked into executing arbitrary operating system commands with the privileges of the `api_server` process.

Unauthenticated network access required.
Sending pickled data to `/update_weights`.
Arbitrary command execution as `api_server`.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the affected system by sending specially crafted pickled data to the `/update_weights` endpoint. This occurs because the application deserializes this data without proper validation, leading to command execution with the privileges of the `api_server` process.

System commands execution.
Unauthenticated network requests.
Compromised server integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this critical remote code execution vulnerability. The first practical move involves identifying all instances of the affected technology, confirming their network reachability and business criticality, and then locating the accountable owner for remediation planning.

Own the issue and its remediation.
Verify exposure and business criticality.
Plan and coordinate remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is InternLM LMDeploy?

InternLM LMDeploy is an open-source machine learning framework designed to deploy large language models. It provides infrastructure for serving models efficiently, often running as an API server that handles tasks like model inference and weight management, which allows developers to integrate advanced AI capabilities into their own applications.

What does CWE-502 mean for CVE-2026-119706?

This vulnerability is classified as CWE-502: Deserialization of Untrusted Data. It means the software accepts serialized data—specifically pickled Python objects—and attempts to reconstruct them without verifying if the content is safe. Because the process trusts this incoming data, it inadvertently executes unintended OS commands embedded by the attacker.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted, base64-encoded pickle payload to the /update_weights endpoint. The bug occurs specifically when the system processes this data. It is important to note that simply running the service or connecting to other, legitimate API endpoints does not trigger the execution; the flaw is localized to the deserialization routine within that specific weight update function.

Is my LMDeploy instance at risk?

Halo Surface Signal indicates that because this service is a model serving framework often deployed as a web API, it is frequently reachable over the network. If your /update_weights endpoint is accessible to users or systems outside of a strictly controlled, trusted environment, it faces a higher likelihood of being targeted by unauthenticated network-based requests.

How should I respond to CVE-2026-119706?

Start by identifying every instance of LMDeploy within your environment to determine if they are running a vulnerable version. Work with the system owners to map out where these services are deployed and how they are accessed. Once located, verify their network exposure and prioritize them for remediation by isolating the /update_weights endpoint from untrusted traffic until a permanent fix is applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.