PT-2026-30407 · Fedml Ai · Fedml

Ana10Gy · Published 2026-04-05 · Updated 2026-04-05 · CVE-2026-5536

Mitre

CVSS v3.1

7.3

High

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A weakness has been identified in FedML-AI FedML up to 0.8.9. Affected is the function sendMessage of the file grpc server.py of the component gRPC server. Executing a manipulation can lead to deserialization. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2026-5536

Affected Products

Fedml

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-5536 · Security Note
• https://vuldb.com/vuln/355289/cti · Note
• https://github.com/AnalogyC0de/public_exp/issues/26 · Note
• https://vuldb.com/submit/782201 · Note
• https://vuldb.com/vuln/355289 · Note