Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-93839: LightLLM lets unauthenticated users add nodes via WebSocket

CVE-2026-93839 · published 10 days ago

Summary

The LightLLM service (version 1.2.0 and earlier) does not check who can use the /pd_register WebSocket endpoint, so anyone can create fake nodes. This can expose user prompts, disrupt service by replacing real nodes, or cause the system to contact internal network addresses. Apply the latest update or restrict access to the endpoint to trusted users.

Original advisory text

LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.

References

https://github.com/ModelTC/LightLLM Product
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_http.py#L198... Third Party Advisory
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_http_pd.py#L... Third Party Advisory
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/httpserver_for_p... Third Party Advisory
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/httpserver_for_p... Third Party Advisory
https://www.vulncheck.com/advisories/lightllm-through-1.2.0-missing-authenticati... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93839... Vendor Advisory
https://github.com/ModelTC/lightllm Product
https://nvd.nist.gov/vuln/detail/CVE-2026-93839 Vendor Advisory
https://github.com/ModelTC/LightLLM/issues/1576 Third Party Advisory

Severity

9.9 Critical

CVSS 3.1: 9.8 (NVD)

CVSS 4.0: 9.3 (NVD)

Exploitation

EPSS <1%

Type

CWE-306Missing Authentication for Critical Function

Timeline

Published18 Sep 2026

Updated27 Sep 2026

First seen18 Sep 2026

Sources

CVE-2026-93839 · NVD

CVE-2026-93839 · OSV

Track software like this

Free during beta