CVE-2026-90614: FedML-AI FedML RCE Vulnerability

CVE-2026-90614 Overview

CVE-2026-90614 is an insecure deserialization vulnerability in FedML-AI FedML up to version 0.9.6. The flaw resides in the S3Storage.read_model function inside fedml/core/distributed/communication/s3/remote_storage.py, part of the MQTT+S3 Communication Backend. An attacker who can influence the s3_key_str argument can trigger deserialization of attacker-controlled data. The issue is remotely exploitable across the network and requires low privileges. According to the disclosure record, the project was notified through a public issue report but has not yet responded. The vulnerability is tracked under [CWE-20: Improper Input Validation].

Critical Impact
Remote attackers with low privileges can influence deserialization of untrusted content read from S3, potentially compromising the confidentiality, integrity, and availability of federated learning workloads.

Affected Products

FedML-AI FedML versions up to and including 0.9.6
The S3Storage.read_model function in fedml/core/distributed/communication/s3/remote_storage.py
Deployments using the MQTT+S3 Communication Backend

Discovery Timeline

2026-09-14 - CVE-2026-90614 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in the NVD database

Technical Details for CVE-2026-90614

Vulnerability Analysis

FedML is an open-source federated learning framework that coordinates distributed model training across participants. In FedML up to 0.9.6, the S3Storage.read_model method retrieves serialized model artifacts from an S3 object identified by the s3_key_str argument. The returned payload is deserialized without adequate validation of its source or content. Because deserialization can instantiate arbitrary objects, an attacker who can influence which S3 object is fetched, or who can write to a referenced key, can supply crafted content that executes attacker-controlled logic during parsing. The advisory classifies the flaw as [CWE-20: Improper Input Validation].

Root Cause

The root cause is the absence of trust boundary enforcement around data read from S3. The read_model path treats the retrieved object as safe serialized state and hands it to a deserializer without integrity checks, signature verification, or a restricted object graph. Any actor able to control the value of s3_key_str or the content behind that key controls the object that FedML materializes in memory.

Attack Vector

Exploitation occurs over the network against processes that call S3Storage.read_model. An attacker with low-privileged access to the messaging or storage layer can direct FedML to fetch a malicious object, or can overwrite a key that a legitimate participant will later read. Successful exploitation leads to unsafe object instantiation on the receiving node during federated training rounds.

See the FedML repository and the tracking GitHub Issue #2267 for source-level references. No verified proof-of-concept code is available at this time.

Detection Methods for CVE-2026-90614

Indicators of Compromise

Unexpected reads of S3 objects with keys that do not match the pattern used by legitimate FedML clients or aggregators.
Python processes spawning child processes, network connections, or file writes shortly after invoking S3Storage.read_model.
MQTT control messages containing s3_key_str values pointing to buckets or prefixes outside the trained topology.

Detection Strategies

Instrument remote_storage.py to log every s3_key_str value read and correlate against an allow-list of expected keys.
Enable AWS CloudTrail S3 data events and alert on GetObject calls to keys not owned by the federation coordinator.
Baseline process behavior of FedML worker nodes and alert on deviations following deserialization events.

Monitoring Recommendations

Monitor MQTT topics used by the FedML backend for messages that carry unexpected or attacker-controlled key strings.
Track outbound network connections from FedML training nodes to identify command-and-control activity post-deserialization.
Forward FedML application logs, MQTT broker logs, and S3 access logs into a centralized analytics platform for correlation.

How to Mitigate CVE-2026-90614

Immediate Actions Required

Inventory all FedML deployments and identify hosts running versions at or below 0.9.6.
Restrict which principals can publish MQTT messages that influence s3_key_str values.
Apply strict IAM policies so FedML processes can only read objects from a defined, coordinator-owned prefix.
Isolate FedML worker nodes on segmented networks to limit blast radius if deserialization is triggered.

Patch Information

As of publication, the FedML-AI project has not responded to the disclosure and no fixed release is referenced in the advisory. Track the FedML repository and GitHub Issue #2267 for updates. Additional details are available at VulDB CVE-2026-90614.

Workarounds

Replace unsafe deserialization in S3Storage.read_model with a safe format such as validated JSON or a signed, length-bounded binary format.
Sign model artifacts before upload and verify signatures before the receiving node deserializes them.
Enforce S3 bucket policies that reject writes from any identity other than the federation coordinator.
Run FedML workers under least-privilege OS accounts with no shell or outbound network egress beyond what training requires.

bash

# Example S3 bucket policy restricting writes to a single coordinator role
# Replace ACCOUNT_ID, BUCKET, and COORDINATOR_ROLE with your values
aws s3api put-bucket-policy --bucket BUCKET --policy '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyNonCoordinatorWrites",
      "Effect": "Deny",
      "Principal": "*",
      "Action": ["s3:PutObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::BUCKET/*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalArn": "arn:aws:iam::ACCOUNT_ID:role/COORDINATOR_ROLE"
        }
      }
    }
  ]
}'