CVE-2026-5536 | FedML-AI FedML up to 0.8.9 gRPC server grpc_server.py sendMessage deserialization

A vulnerability labeled as critical has been found in FedML-AI FedML up to 0.8.9. Affected is the function sendMessage of the file grpc_server.py of the component gRPC server. Executing a manipulation can lead to deserialization.

This vulnerability appears as CVE-2026-5536. The attack may be performed from remote. There is no available exploit.

The vendor was contacted early about this disclosure but did not respond in any way.