LightLLM through version 1.2.0 exposes reinforcement learning control routes on its public HTTP API without requiring authentication. Attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group without credentials, enabling them to interfere with inference workflows and disrupt deployed workers running with the --enable_rl option.

Unauthenticated attackers can disrupt inference operations by invoking critical control functions, potentially causing denial of service or degraded performance in deployments using reinforcement learning features. This can wedge worker processes and interrupt normal model operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected API endpoints to trusted users only and avoid enabling reinforcement learning control routes on publicly accessible interfaces.