Remote Code Execution in LMDeploy via Unsafe Pickle Deserialization

LMDeploy is vulnerable to remote code execution (CVE-2026-76850) due to unsafe deserialization practices within its disaggregated serving component. The issue resides in the handle_zmq_recv coroutine, which utilizes the recv_pyobj() method to process peer-to-peer cache-free requests. This method inherently relies on pickle.loads() to deserialize incoming bytes. Crucially, the validation check against the expected object type (DistServeCacheFreeRequest) occurs only after the deserialization process is complete.

An unauthenticated remote attacker can exploit this by interacting with the /distserve/p2p_initialize or /distserve/p2p_connect endpoints in the OpenAI-compatible API server. Since authentication is disabled by default, an attacker can manipulate the ZMQ address parameter, forcing the victim engine to connect to an attacker-controlled ZMQ PULL socket. The attacker then provides a serialized pickle payload, which is executed within the engine process upon receipt. This vulnerability only impacts deployments where disaggregated serving is actively configured and utilized.

Impact

Successful exploitation results in full remote code execution within the context of the LMDeploy engine process. This allows an attacker to compromise the underlying host, access sensitive model data, exfiltrate environment variables, or persist within the infrastructure supporting the LLM serving environment. The severity is CVSS 9.8 (Critical), reflecting the ease of exploitability and the potential for complete system takeover.

Recommendation

• Immediately disable the disaggregated serving feature if it is not strictly required for current operations.
• If disaggregated serving is required, enforce API key authentication by configuring the LMDeploy server to require authentication keys, ensuring the default None value is overridden.
• Implement network-level segmentation to restrict access to the /distserve/* API endpoints to known, trusted internal peers only.
• Audit LMDeploy configuration files to ensure that remote endpoints are not accepting input from untrusted ZMQ sources.