Description

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.read_model of the file fedml/core/distributed/communication/s3/remote_storage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3_key_str causes deserialization. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-14T02:17:15.857Z",
  "pubdate": "2026-09-14T02:17:15.857Z",
  "executiveSummary": "A critical deserialization vulnerability has been identified in FedML-AI FedML versions up to 0.9.6, specifically within the MQTT+S3 communication backend.\nThe vulnerability originates from the improper handling of the 's3_key_str' argument in the 'S3Storage.read_model' function located in 'fedml/core/distributed/communication/s3/remote_storage.py'.\nAn unauthenticated remote attacker can exploit this flaw to achieve remote code execution (RCE) by supplying a maliciously crafted object, which the system deserializes without validation.\nThe impact of this vulnerability is severe, potentially allowing an attacker to compromise the integrity and availability of the affected system, gain unauthorized access, and execute arbitrary commands in the context of the FedML process.\nGiven that the project has been notified but remains unresponsive, users are exposed to ongoing risks. Immediate defensive measures, such as network segmentation and input validation, are strongly recommended to mitigate potential exploitation.",
  "technicalDetails": "The vulnerability resides in the 'S3Storage.read_model' function within the 'fedml/core/distributed/communication/s3/remote_storage.py' file. This component is responsible for retrieving model artifacts from S3 storage for distributed training workflows within the FedML framework.\nThe root cause of this vulnerability is the use of insecure deserialization routines on data sourced from the 's3_key_str' parameter. In Python, utilizing methods like 'pickle.load' or similar insecure deserialization libraries on untrusted input facilitates arbitrary code execution. Because the input 's3_key_str' is processed as a key for an S3 storage operation, an attacker who can influence the content retrieved from or associated with this key can inject serialized object streams.\nThe exploitation flow begins with the attacker identifying a mechanism to influence the 's3_key_str' argument, which is then passed into the 'read_model' method. Upon invocation, the vulnerable function retrieves the data associated with this key. If the underlying logic uses an unsafe deserialization process (e.g., standard 'pickle' module) to reconstruct the object from the retrieved data stream, it will instantiate the attacker-supplied object.\nDuring the deserialization process, specially crafted payloads containing malicious '__reduce__' methods can be triggered to execute arbitrary system commands. Since 'S3Storage.read_model' is part of the communication backend, this operation is often invoked in a distributed environment, potentially across network boundaries. The attack does not require prior authentication if the endpoint that triggers this storage retrieval is exposed and accepts remote input.\nThe post-exploitation impact allows for full control over the execution environment of the FedML component. An attacker could establish a reverse shell, exfiltrate sensitive model weights, poison model training data, or pivot through the internal network of the distributed training cluster. This vulnerability is classified as critical because it bypasses conventional security controls by leveraging legitimate application functions to perform unauthorized actions during object reconstruction.\nThe affected versions include all releases of FedML up to 0.9.6. The architectural design of the MQTT+S3 communication backend lacks the necessary security boundary to sanitize or cryptographically verify the integrity of the data being deserialized, making it inherently susceptible to code injection attacks when the storage backend is controlled or manipulated by an external entity."
}