CVE-2026-76850

Name of the Vulnerable Software and Affected Versions LMDeploy (affected versions not specified)

Description LMDeploy contains an issue where disaggregated-serving peer messages are deserialized using the pickle module. The handle zmq recv coroutine in lmdeploy/pytorch/disagg/conn/engine conn.py uses the recv pyobj() function to read peer-to-peer cache-free requests, which invokes pickle.loads() on the received bytes. Because the type check for DistServeCacheFreeRequest occurs only after deserialization, a remote attacker can exploit this by controlling the peer that supplies the bytes. The p2p connect function passes the remote engine endpoint info.zmq address from the request body to the ZMQ PULL socket. Furthermore, the endpoints 'POST /distserve/p2p initialize' and 'POST /distserve/p2p connect' in lmdeploy/serve/openai/api server.py do not require authentication by default. This allows an attacker to direct an engine to pull data from a malicious ZMQ endpoint and execute arbitrary code within the engine process. This issue only affects deployments with disaggregated serving enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Start the server with api keys enabled to ensure authentication for the affected endpoints. Disable disaggregated serving if it is not required for the deployment.