EUVD-2026-85294

LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pdtransmode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC...

CVE-2026-96560

LightLLM versions through 1.2.0 are vulnerable to remote code execution (RCE) due to a flaw in the KV-transfer worker . When the service is started with the --pd_trans_mode nccl flag, it exposes an unauthenticated RPyC control channel . This channel is susceptible to the deserialization of untrus...

PT-2026-97321

Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description Remote code execution is possible in the KV-transfer worker when the service is started with the --pd trans mode nccl configuration. This configuration exposes an unauthenticated RPyC control channe...