Unauthenticated Remote Code Execution in LightLLM by ModelTC
CVE-2026-103041

9.3CRITICAL

Key Information:

Vendor

Modeltc

Status
Lightllm
Vendor
CVE Published:
29 September 2026

What is CVE-2026-103041?

LightLLM versions up to 1.2.0 are vulnerable due to an unauthenticated RPyC (Remote Python Call) cache service that enables pickle deserialization on all interfaces. This flaw allows attackers to send specially crafted serialized objects to the exposed cache methods, leading to the execution of arbitrary code with the privileges of the service. Proper security measures and patches should be applied to mitigate this risk.

Affected Version(s)

LightLLM 0 <= 1.2.0

References

https://github.com/ModelTC/LightLLM/issues/1596
issue-tracking
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/...
technical-description
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/...
technical-description

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mingkai Yu
Jiapeng Li
Jiajia Liu
.