Executive brief
LMDeploy is a toolkit for deploying and serving large language models. When disaggregated serving mode is enabled, the application deserializes peer messages using Python's pickle module without proper validation, allowing a remote attacker to execute arbitrary code on the engine server if the API is not protected with authentication keys.
Technical details
LMDeploy's handle_zmq_recv coroutine in engine_conn.py uses recv_pyobj() to deserialize peer-to-peer cache-free requests with pickle.loads() before validating the message type. The ZMQ PULL socket endpoint address is controlled by the attacker via the remote_engine_endpoint_info.zmq_address parameter in the POST /distserve/p2p_initialize and /distserve/p2p_connect endpoints. These API endpoints lack authentication by default (api_keys defaults to None). An attacker can supply a malicious ZMQ endpoint, causing the engine to pull and deserialize crafted pickle payloads, achieving remote code execution. The vulnerability only affects deployments with disaggregated serving explicitly enabled.
Affected products
- InternLM LMDeploy
Timeline
- 2026-08-19: disclosed