CVE-2026-103040

Deferred Deferred - Pending Action

Remote Code Execution in LightLLM via Unauthenticated RPyC Pickle Deserialization

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted serialized objects to the profiler command queue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-09-30

AI Q&A

2026-09-30

EPSS Evaluated

N/A

NVD

CVE-2026-103040

EUVD

EUVD-2026-89481

Affected Vendors & Products

Vendor	Product	Version / Range
lightllm	lightllm	to 1.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

LightLLM through version 1.2.0 has a remote code execution flaw in its router profiler service when started with the --enable_profiling flag. This service runs an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending specially crafted serialized objects to the profiler command queue.

Detection Guidance

Check if LightLLM is running with the --enable_profiling flag. Inspect network traffic for unauthenticated RPyC server connections on the profiler port. Look for unexpected pickle deserialization activity in logs.

Impact Analysis

An attacker could exploit this to run malicious code on the server running LightLLM, potentially gaining full control over the system. This could lead to data theft, unauthorized access, or disruption of services if the server is exposed to untrusted networks.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Disable the --enable_profiling flag if enabled. Block or restrict access to the profiler service port. Update LightLLM to a version that patches this vulnerability.

Hi! I’m here to help you understand CVE-2026-103040. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70