Critical severity · published Sep 18, 2026
CVE-2026-93839
LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LightLLM · ModelTC
through 1.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93839
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93839
github.com
https://github.com/ModelTC/LightLLM
github.com
https://github.com/ModelTC/LightLLM/issues/1576
github.com
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_http.py#L198-L205
github.com
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_http_pd.py#L26-L36
github.com
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/httpserver_for_pd_master/manager.py#L691-L698
github.com
https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/httpserver_for_pd_master/manager.py#L714-L749
More from LightLLM
9.8
CVE-2026-103395
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service
9.8
CVE-2026-103041
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service
9.8
CVE-2026-103040
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service
9.8
CVE-2026-96560
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel
9.8
CVE-2026-90919
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization