CVE-2026-76850

CVE-2026-76850 exposes a critical architectural failure in disaggregated serving: the p2p initialization path deserializes data from caller-controlled ZMQ endpoints without authentication, and it does so by default when this serving mode is enabled. The vulnerability is a 9.8 because the default configuration makes the attack surface internet-reachable — api_keys defaults to None, meaning no authentication is required to trigger the vulnerable code path. The vulnerable flow starts when the migration backend accepts a connection to initialize peer discovery. The caller provides a ZMQ endpoint, which is then used for recv_pyobj() — Python's pickle-based object reception on a network socket. This is the exact pattern every security training module warns against: unpickling data from an unauthenticated remote caller. The disaggregated serving architecture didn't create a novel exploitation condition; it made a known-dangerous pattern reachable from the internet by default. If you're running LMDeploy with disaggregated serving enabled, your priority is determining whether p2p initialization is active in your deployment. Check whether the migration backend is exposed to unauthenticated callers — if it is, attackers can supply malicious ZMQ endpoints that result in arbitrary code execution when the peer connection is established. The safest immediate response is to disable disaggregated serving if you don't actively need it, or to ensure api_keys are configured and the migration backend is not internet-facing. The api_keys default to None specifically because authentication was treated as an optional deployment concern rather than a foundational requirement — that design choice is what elevates this from a 7.5 to a 9.8. Beyond patching, audit for other conditionally-activated code paths in your serving stack that may have similar structural flaws: any path where external input can control endpoint addresses or serialization targets should be treated as high-risk, regardless of whether it's documented as a feature. The pattern of flexible peer discovery paired with known-unsafe deserialization has appeared repeatedly across distributed ML serving systems — this is the fourth identifiable mutation of the same vulnerability family in the past decade. Assume other paths in your codebase share the same implicit trust model until proven otherwise.

Reviewed through automated stages and approved by a human before publication.