What’s Vulnerable › Vulnerabilities

CVE-2026-103040: LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-29 · updated 2026-09-30
• Weakness: CWE-502

Description

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted serialized objects to the profiler command queue.

Affected products

• ModelTC LightLLM: through 1.2.0

References

• https://github.com/ModelTC/LightLLM
• https://github.com/ModelTC/LightLLM/issues/1597
• https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/profiler_service.py#L32-L34
• https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/profiler_service.py#L46-L50
• https://www.vulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-remote-code-execution-via-router-profiler-rpyc-service
• https://github.com/ModelTC/LightLLM/issues/1597

Get alerted when CVE-2026-103040 or the next vulnerability affects your stack