Deserialization Vulnerability in FedML-AI gRPC Server by FedML
CVE-2026-5536

6.9MEDIUM

Key Information:

Vendor

Fedml-ai

Status
Fedml
Vendor
CVE Published:
5 April 2026

What is CVE-2026-5536?

A vulnerability has been discovered in the gRPC server component of FedML-AI, specifically within the sendMessage function in grpc_server.py. This flaw enables remote attackers to exploit deserialization issues, potentially leading to unauthorized code execution on affected systems. Despite being notified of the issue, the vendor has yet to provide a response or patch, leaving users at risk.

Affected Version(s)

FedML 0.8.0

FedML 0.8.1

FedML 0.8.2

References

https://vuldb.com/vuln/355289
vdb-entrytechnical-description
https://vuldb.com/vuln/355289/cti
signaturepermissions-required
https://vuldb.com/submit/782201
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ana10gy (VulDB User)
VulDB CNA Team
.