What happened
Published 2026-08-19 with CVSS 9.8 (Critical), this is an unauthenticated remote code execution vulnerability in LMDeploy's disaggregated-serving component caused by pickle deserialization of untrusted peer messages occurring before type validation.
Why it matters
LMDeploy is a production LLM inference-serving engine; unauthenticated pre-auth RCE in the model-serving process directly threatens the confidentiality of model weights and any co-located secrets, and enables an attacker to pivot from a single exposed inference endpoint into the broader ML infrastructure — a textbook example of a widely-deployed model-serving component with a critical, easily-weaponized deserialization flaw.
Attack vector
The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py deserializes peer-to-peer cache-free requests using pickle.loads() before performing a type-check (isinstance against DistServeCacheFreeRequest). The unauthenticated POST /distserve/p2p_initialize and /distserve/p2p_connect endpoints let a remote attacker supply a ZMQ address under their control; the engine then pulls and pickle-deserializes attacker-controlled bytes, executing arbitrary code in the LLM engine process. Authentication is disabled by default (api_keys defaults to None).
Affected systems
InternLM LMDeploy versions 0.9.2 and later before 0.16.0 (with disaggregated serving enabled)
Mitigation
Upgrade to LMDeploy ≥0.16.0. Enable api_keys authentication on all serving endpoints; do not expose disaggregated-serving p2p endpoints to untrusted networks; restrict network access to peer-connection ports.