CVE-2026-93839criticalCWE-306

CVE-2026-93839: falha crítica em ModelTC LightLLM

LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar LightLLM

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.8%
LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
ModelTC · LightLLM
CVEs relacionadas — ModelTC LightLLM

No mesmo produto, das mais perigosas para as menos.

CVE-2026-96560CRITICALLightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control ChannelEPSS 1.2%CVE-2026-90919CRITICALLightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle DeserializationEPSS 1.1%CVE-2026-103040CRITICALLightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC ServiceEPSS 1.0%CVE-2026-26220CRITICALLightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCEEPSS 1.0%CVE-2026-103041CRITICALLightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC ServiceEPSS 0.8%CVE-2026-103042HIGHLightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_valueEPSS 0.6%