CVE-2026-123818highBroken access control2026-11-09
CVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with url
LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request.
What it is
LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation hostname appears globally routable but whose request destination resolves to an internal host, bypassing non-global address checks.
How to check
- Compare your installed version with the range above (command below).
How to fix
Sources
More advisories for this tool
- criticalCVE-2026-119706: LMDeploy api_server runs attacker pickles sent to /update_weights, unauthenticated RCE in 0.9.0 to 0.18.0, still unfixed
- criticalCVE-2025-66455: LMDeploy DistServe connects to attacker ZeroMQ peers and unpickles their messages, unauthenticated RCE before 0.16.0
- criticalCVE-2025-59953: LMDeploy's ZeroMQ RPC server unpickles incoming messages, remote code execution in 0.9.1 to 0.10.1
- highCVE-2026-46432: LMDeploy before 0.13.0 always loads models with trust_remote_code=True, so a malicious model repo runs code