What’s Vulnerable › Vulnerabilities

CVE-2026-90614: FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-14
• Weakness: CWE-20

Description

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.read_model of the file fedml/core/distributed/communication/s3/remote_storage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3_key_str causes deserialization. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

• FedML-AI FedML: 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5 (+1)

References

• https://github.com/FedML-AI/FedML/
• https://github.com/FedML-AI/FedML/issues/2267
• https://vuldb.com/cve/CVE-2026-90614
• https://vuldb.com/submit/914219
• https://vuldb.com/vuln/403196
• https://vuldb.com/vuln/403196/cti

Get alerted when CVE-2026-90614 or the next vulnerability affects your stack