---
id: "CVE-2026-119706"
kind: "vulnerability"
aliases: ["CVE-2026-119706"]
title: "LMDeploy: unauthenticated pickle upload to /update_weights runs OS commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-inference", "ai-tooling", "lmdeploy", "python", "self-hosted"]
not_affected_if: ["no-network-exposure", "versions-outside-range"]
published_at: "2026-10-30T16:17:51+00:00"
first_seen_at: "2026-10-30T16:31:26+00:00"
updated_at: "2026-10-30T16:31:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119706", "first_seen_at": "2026-10-30T16:31:26+00:00"}]
---

# LMDeploy: unauthenticated pickle upload to /update_weights runs OS commands

InternLM LMDeploy versions 0.9.0 through 0.18.0 deserialize pickled data sent to the /update_weights endpoint without validation. A remote attacker can send a crafted pickle and run OS commands as the api_server process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed LMDeploy version with `pip show lmdeploy`, and look for it in any requirements or lock files.
- Look for an exposed `/update_weights` endpoint on servers running `lmdeploy serve api_server`.

## Fix

- Move to a version outside `0.9.0` through `0.18.0`; the fixed version is unknown from the sources.

## Timeline

- 2026-10-30T16:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119706

## From the sources

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_