# CVE-2026-76850: LMDeploy unsafe pickle deserialization in disaggregated serving

Source: https://junglewise.ai/threats/cve-2026-76850-lmdeploy-unsafe-pickle-deserialization-in-disaggregated-serving  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76850 · Severity: critical · CVSS 9.8 · Published 2026-08-19

LMDeploy is a toolkit for deploying and serving large language models. When disaggregated serving mode is enabled, the application deserializes peer messages using Python's pickle module without proper validation, allowing a remote attacker to execute arbitrary code on the engine server if the API is not protected with authentication keys.

## Quick answers

**Is CVE-2026-76850 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76850 being exploited in the wild.

**How severe is CVE-2026-76850?** Critical severity, with a CVSS score of 9.8, published 19 August 2026.

**Which products and versions are affected?** InternLM LMDeploy.

**Is there a fix for CVE-2026-76850?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76850 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76850?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

LMDeploy's handle_zmq_recv coroutine in engine_conn.py uses recv_pyobj() to deserialize peer-to-peer cache-free requests with pickle.loads() before validating the message type. The ZMQ PULL socket endpoint address is controlled by the attacker via the remote_engine_endpoint_info.zmq_address parameter in the POST /distserve/p2p_initialize and /distserve/p2p_connect endpoints. These API endpoints lack authentication by default (api_keys defaults to None). An attacker can supply a malicious ZMQ endpoint, causing the engine to pull and deserialize crafted pickle payloads, achieving remote code execution. The vulnerability only affects deployments with disaggregated serving explicitly enabled.

## Affected products

- InternLM LMDeploy

## Timeline

- 2026-08-19: disclosed

## References

- [https://pypi.org/](https://pypi.org/)
- [https://github.com/InternLM/lmdeploy](https://github.com/InternLM/lmdeploy)