Threat database

LightLLM versions up to 1.2.0 have a denial of service vulnerability where unauthenticated attackers can crash the inference worker by sending crafted data to the /generate endpoint. The issue arises from deserialization failure in the internal pd_kv_trans_params field, causing the inference thread to terminate while the health endpoint remains responsive, resulting in a hang of subsequent requests until a restart occurs.

CVE-2026-103395 is a critical vulnerability in ModelTC LightLLM versions up to 1.2.0. The vulnerability arises from an unauthenticated RPyC service with allow_pickle enabled, which deserializes attacker-controlled data in the remote_infer_images method. This allows remote attackers to execute arbitrary code with service account privileges by passing specially crafted objects.

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference operations and wedge workers on deployments started with --enable_rl.

CVE-2026-103243 is a server-side request forgery (SSRF) vulnerability in ModelTC LightLLM versions up to 1.2.0. The vulnerability arises because the product fails to validate the image_url and audio_url parameters in its multimodal endpoints. This allows unauthenticated attackers to supply arbitrary URLs, causing the server to fetch internal resources. The vision model processing can disclose content or error responses that reveal internal network topology. The vulnerability has a medium severity with a CVSS score of 6.9.

LightLLM versions up to 1.2.0 have a memory exhaustion vulnerability in the NCCL control channel when started with the --pd_trans_mode nccl option. This flaw allows unauthenticated attackers to invoke the exposed_set_value method to store unlimited key-value pairs without size restrictions, leading to exhaustion of KV-transfer worker memory. The resulting memory exhaustion causes the worker process to crash and triggers node failure.

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges.

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted serialized objects to the profiler command queue.

LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC ThreadedServer to execute arbitrary code with the privileges of the LightLLM service account.

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint that passes the first client frame directly to pickle.loads(). Attackers can reach the Config Server port and send a malicious serialized payload with a __reduce__ method to execute arbitrary code with Config Server process privileges.

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads() without authentication or validation. A remote attacker who can reach the PD master can send a crafted payload to achieve arbitrary code execution.