Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

LightLLM up to 1.2.0 can run attacker code

CVE-2026-103040 · published 19 days ago
Summary

If LightLLM is started with the profiling option turned on, it opens a network service that anyone can reach. An attacker could send specially crafted data to that service and cause the program to run whatever code they choose. Disable the profiling flag or upgrade to a version where this behavior is fixed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
modeltc lightllm <= 1.2.0
Original advisory text
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted serialized objects to the profiler command queue.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published29 Sep 2026
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-103040 · NVD
CVE-2026-103040 · MITRE
CVE-2026-103040 · OSV
Track software like this
Free during beta