CVE-2026-26220 is a critical vulnerability in ModelTC's LightLLM product, affecting version 1.1.0 and prior. The vulnerability arises from unsafe deserialization of untrusted data via Python's pickle.loads() function in the PD master node's WebSocket endpoints. Because there is no authentication or validation on incoming binary frames, a remote attacker with network access to the PD master node can send malicious serialized data to execute arbitrary code remotely. This vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and has a CVSS 4.0 base score of 9.3, indicating high impact and ease of exploitation.

Successful exploitation results in unauthenticated remote code execution on the PD master node of LightLLM. This can lead to full system compromise, data breach, or disruption of service. The vulnerability requires network access to the PD master node but no privileges or user interaction. The CVSS 4.0 vector indicates no attack complexity, no privileges required, and no user interaction needed, with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the PD master node to trusted entities only to prevent unauthorized access to the vulnerable WebSocket endpoints. Monitor for unusual activity targeting these endpoints. Do not expose the PD master node to untrusted networks.