CVE-2026-93839

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pdregister WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket...

EUVD-2026-83283

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pdregister WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket...

CVE-2026-93839 LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pdregister WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket...

CVE-2026-93839

LightLLM (by ModelTC) through version 1.2.0 contains a missing authentication vulnerability in the /pd_register WebSocket endpoint of the PD Master component. An unauthenticated attacker can register arbitrary nodes by supplying crafted JSON that bypasses peer address validation. Successful explo...

CVE-2026-90919

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visualregister WebSocket endpoint that passes the first client frame directly to pickle.loads. Attackers can reach the Config Server port and send a malicious serialized payload with a...

CVE-2026-90919 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visualregister WebSocket endpoint that passes the first client frame directly to pickle.loads. Attackers can reach the Config Server port and send a malicious serialized payload with a...

CVE-2026-90919 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visualregister WebSocket endpoint that passes the first client frame directly to pickle.loads. Attackers can reach the Config Server port and send a malicious serialized payload with a...

EUVD-2026-77429

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visualregister WebSocket endpoint that passes the first client frame directly to pickle.loads. Attackers can reach the Config Server port and send a malicious serialized payload with a...

CVE-2026-90919

LightLLM through 1.2.0 is vulnerable to unauthenticated remote code execution via the Config Server 's /visual_register WebSocket endpoint. The endpoint passes the first client frame directly to pickle.loads() , allowing an attacker who can reach the Config Server port to send a malicious seriali...

CVE-2026-26220

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD prefill-decode disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads without authentication or validation. A...

CVE-2026-26220

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD prefill-decode disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads without authentication or validation. A...

CVE-2026-26220

CVE-2026-26220 affects LightLLM

CVE-2026-26220 LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD prefill-decode disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads without authentication or validation. A...

CVE-2026-26220 LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD prefill-decode disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads without authentication or validation. A...

CVE-2026-26220 LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD prefill-decode disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads without authentication or validation. A...

LightLLM 代码问题漏洞

LightLLM is an open-source language model inference and service framework developed by ModelTC. Versions of LightLLM 1.1.0 and earlier contained code vulnerabilities. These vulnerabilities stemmed from unauthenticated or improperly authenticated WebSocket endpoints exposed by PD master nodes, whi...

PT-2026-8395

Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.1.1 Description An unauthenticated remote code execution issue exists in PD prefill-decode disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly t...