Vulnerability Description
LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC ThreadedServer to execute arbitrary code with the privileges of the LightLLM service account.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/ModelTC/LightLLM/issues/1590
- https://github.com/ModelTC/lightllm
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_inf
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_inf
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_inf
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_inf
- https://www.vulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-remo
FAQ
What is CVE-2026-96560?
CVE-2026-96560 is a vulnerability with a CVSS score of 9.8 (CRITICAL). LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deser...
How severe is CVE-2026-96560?
CVE-2026-96560 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-96560?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.