Authentication Bypass in LightLLM by ModelTC

CVE-2026-93839

What is CVE-2026-93839?

LightLLM, a platform by ModelTC, is susceptible to an authentication bypass vulnerability found in the /pd_register WebSocket endpoint. This flaw allows unauthenticated attackers to register arbitrary nodes by sending specially crafted JSON requests, which lack necessary peer address validation. Exploiting this vulnerability enables attackers to access full user prompts through their WebSocket connection, potentially leading to denial of service by replacing legitimate nodes or forcing the PD Master to make requests to internal network addresses. Prompt action is advised to mitigate these security risks.

References