What’s Vulnerable › Products

ModelTC LightLLM vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your ModelTC LightLLM version is affected

Latest ModelTC LightLLM vulnerabilities

• CVE-2026-111160 — LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization (CVSS 7.5)
• CVE-2026-103395 — LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service (CVSS 9.8)
• CVE-2026-103270 — LightLLM through 1.2.0 Missing Authentication on RL Control Routes (CVSS 7.5)
• CVE-2026-103243 — LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints (CVSS 5.8)
• CVE-2026-103042 — LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value (CVSS 7.5)
• CVE-2026-103041 — LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service (CVSS 9.8)
• CVE-2026-103040 — LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service (CVSS 9.8)
• CVE-2026-96560 — LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel (CVSS 9.8)
• CVE-2026-93839 — LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint (CVSS 9.8)
• CVE-2026-90919 — LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization (CVSS 9.8)
• CVE-2026-26220 — LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE (CVSS 9.3)