External risk intelligence

LMDeploy Remote Code Execution via Unsafe Pickle Deserialization

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-76850

The vulnerability affects an API server component that listens for requests. While it involves disaggregated serving, the API endpoints that trigger the vulnerable code are network-accessible and do not require authentication by default, making them reachable if the service is exposed to the internet or an untrusted network.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in LMDeploy's disaggregated serving feature. The system improperly handles serialized data from external sources, allowing an unauthenticated attacker to execute arbitrary code on the affected engine process. This could pose a significant risk if this feature is enabled and exposed.

Unsafe data handling allows remote code execution.
Critical if disaggregated serving is enabled.
Assess relevance and confirm exposure.

Attack Path

How an attacker could exploit the issue

An attacker can compromise a system running LMDeploy by controlling a remote engine to pull specially crafted messages. These messages are processed by a vulnerable deserialization function that does not perform checks before executing arbitrary code. This attack is possible when disaggregated serving is enabled and the server is not configured with API keys for authentication.

Unauthenticated network access required.
Unsafe deserialization of peer messages.
Arbitrary code execution in the engine process.

Live Threat

Current exploitation, exposure, and threat context

When disaggregated serving is enabled and not secured, this vulnerability could allow an attacker to execute arbitrary code on the engine process by directing it to pull from a controlled endpoint. This could impact the integrity and availability of the service.

Arbitrary code execution in engine process.
Unauthenticated network requests can trigger.
Potential denial of service or system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams managing AI model deployments and their supporting infrastructure, such as platform or MLOps teams, are likely responsible for addressing this vulnerability. The first practical step is to determine if disaggregated serving is enabled and if the affected API endpoints are exposed to untrusted networks. If so, identify the accountable owner and prioritize remediation based on the criticality of the affected models and the exposure risk.

Identify AI platform owners.
Verify disaggregated serving is enabled.
Plan remediation for exposed endpoints.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LMDeploy and why is it used?

LMDeploy is a toolkit for compressing, deploying, and serving large language models. It is designed to optimize model performance and efficiency, often used by developers and MLOps teams to run inference servers for high-performance AI applications. This vulnerability specifically relates to the disaggregated serving component, which allows the engine to distribute workloads across different nodes.

What is the vulnerability in CVE-2026-76850?

This vulnerability is classified as CWE-502: Deserialization of Untrusted Data. The system uses Python's 'pickle' module to process peer-to-peer messages from external sources. Because it attempts to reconstruct complex objects from these messages before verifying what they are, an attacker can craft malicious data that forces the application to execute unintended code as soon as the data is loaded.

How can an attacker trigger this CVE?

An attacker can trigger this by directing a vulnerable engine to connect to a ZMQ endpoint they control. The application will then pull data from that source and deserialize it. It is important to note that this process only occurs when disaggregated serving is enabled; deployments that do not use this feature or have not started the migration backend will not initiate the vulnerable receive loop.

Do I need to worry if my LMDeploy instance is internal?

Halo Surface Signal indicates this vulnerability is most relevant when the API server is reachable from untrusted networks. If your instance is exposed to the internet, it is at higher risk because the API endpoints do not require authentication by default. However, even if internal, any attacker or compromised service with network access to these API endpoints can trigger the flaw if the server lacks configured API keys.

What is the first step to address this risk?

Start by checking your configuration to see if disaggregated serving is active. If it is enabled, verify whether you have implemented API key authentication, as the default state provides no protection against unauthorized requests. If you are using this feature without authentication, restrict network access to the API endpoints immediately and plan to update to a patched version of the software.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.