---
title: LMDeploy 0.9.0 to 0.18.0: unauthenticated RCE (CVE-2026-119706, CVSS 9.8) through the api_server /update_weights endpoint, which unpickles request data; no fixed release yet | ctxsec
url: https://ctxsec.com/items/lmdeploy-cve-2026-119706-update-weights-pickle-unauth-rce-unpatched
description: ""
status: "official CVE (VulnCheck CNA, Oct 30); fix PR still open, no patched release yet; no exploitation reported"
published: 2026-10-30
---

> 

[← AI](/ai) · [markdown](/items/lmdeploy-cve-2026-119706-update-weights-pickle-unauth-rce-unpatched.md)

official CVE (VulnCheck CNA, Oct 30); fix PR still open, no patched release yet; no exploitation reported

2026-10-30

### LMDeploy 0.9.0 to 0.18.0: unauthenticated RCE (CVE-2026-119706, CVSS 9.8) through the api_server /update_weights endpoint, which unpickles request data; no fixed release yet

InternLM's **LMDeploy** LLM serving toolkit exposes an `/update_weights` endpoint on its OpenAI-compatible `api_server`. Per VulnCheck, a request can carry a base64-encoded pickle in `serialized_named_tensors`, which is deserialized with `ForkingPickler.loads` without validation, running commands as the server process with no authentication.

- **Affected:** 0.9.0 through 0.18.0 (latest release, Sep 28).
- **Fix status:** pull request 4964 ("Reject pickle on HTTP /update_weights") was still open when this was published; no patched release yet.
- **Exploitation:** none reported.

**Do now:** never expose an LMDeploy api_server to untrusted networks; put it behind an authenticating proxy that blocks `/update_weights`, and watch for the fixed release.

Sources: [VulnCheck: LMDeploy 0.9.0 through 0.18.0 unauthenticated RCE via /update_weights pickle deserialization](https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticated-rce-via-update-weights-pickle-deserialization) · [GitHub: InternLM/lmdeploy PR 4964, "Reject pickle on HTTP /update_weights" (open as of Oct 30)](https://github.com/InternLM/lmdeploy/pull/4964) · [NVD: CVE-2026-119706](https://nvd.nist.gov/vuln/detail/CVE-2026-119706)