CVE-2026-5536

A weakness has been identified in FedML-AI FedML up to 0.8.9. Affected is the function sendMessage of the file grpc_server.py of the component gRPC server. Executing a manipulation can lead to deserialization. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-20
• CWE-502

• https://github.com/AnalogyC0de/public_exp/issues/26Third Party Advisory
• https://vuldb.com/submit/782201Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/355289Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/355289/ctiPermissions Required

Published

Apr 5, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5530A flaw has been found in Ollama up to 0.18.1. This issue aff…6.3
• CVE-2026-5531A vulnerability has been found in SourceCodester Student Res…5.5
• CVE-2026-5532A vulnerability was found in ScrapeGraphAI scrapegraph-ai up…6.3
• CVE-2026-5533A vulnerability was determined in badlogic pi-mono 0.58.4. T…4.3
• CVE-2026-5534A vulnerability was identified in itsourcecode Online Enroll…7.3
• CVE-2026-5535A security flaw has been discovered in FedML-AI FedML up to …5.4
• CVE-2026-5537A security vulnerability has been detected in halex CourseSE…6.3
• CVE-2026-55370Logto is the modern, open-source auth infrastructure for Saa…6.4
• CVE-2026-55377Logto is the modern, open-source auth infrastructure for Saa…8.1
• CVE-2026-55379Pillow is a Python imaging library. Prior to 12.3.0, PIL/Bdf…7.5
• CVE-2026-5538A vulnerability was detected in QingdaoU OnlineJudge up to 1…6.3
• CVE-2026-55380Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdI…7.5