CVE-2026-25874: LeRobot Unsafe Deserialization Remote Code Execution via gRPC
LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the policy server and robot client components. An unauthenticated network-reachable attacker can achieve arbitrary code execution on the server or client by sending a crafted pickle payload through the SendPolicyInstructions, SendObservations, or GetActions gRPC calls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable TLS for gRPC channels and require authentication (e.g., mTLS or other authentication) so that unauthenticated plaintext gRPC connections are not accepted by the policy server or robot client.
LeRobot policy server and robot client (gRPC channels) TLS and authentication for gRPC = enabled - Configuration
Stop using pickle.loads() to deserialize data received over gRPC. Replace unsafe pickle deserialization with a safe deserialization approach and validate inputs before deserializing.
LeRobot policy server and robot client pickle.loads() deserialization = disabled - Compensating control
Restrict network reachability of the policy server and robot client gRPC endpoints to trusted hosts/networks (firewall, VPN, network ACLs) to prevent unauthenticated network-accessible attackers from reaching the services.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25874?
CVE-2026-25874 has a critical severity rating due to its potential for remote code execution.
How do I fix CVE-2026-25874?
To fix CVE-2026-25874, ensure the use of authenticated gRPC channels and avoid using pickle.loads() for deserialization.
What are the impacts of CVE-2026-25874?
CVE-2026-25874 can allow an attacker to execute arbitrary code on the affected system via unsafe deserialization.
Which versions of LeRobot are affected by CVE-2026-25874?
CVE-2026-25874 affects all versions of LeRobot that use unsafe deserialization in the async inference pipeline.
Is CVE-2026-25874 exploitable without authentication?
Yes, CVE-2026-25874 is exploitable over unauthenticated gRPC channels, making it particularly dangerous.