CVE-2026-103041

Deferred Deferred - Pending Action

Unauthenticated Remote Code Execution in LightLLM Cache Service

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-09-30

AI Q&A

2026-09-30

EPSS Evaluated

N/A

NVD

CVE-2026-103041

EUVD

EUVD-2026-89482

Affected Vendors & Products

Vendor	Product	Version / Range
lightllm	lightllm	to 1.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

LightLLM through version 1.2.0 has a vulnerability where multimodal deployments expose an unauthenticated RPyC cache service with enabled pickle deserialization on all interfaces. This allows attackers to send crafted serialized objects to cache methods, leading to arbitrary code execution with the service's privileges.

Detection Guidance

Check for open ports 18812 and 18860 on LightLLM deployments using netstat or ss. Scan for RPyC cache service endpoints with tools like nmap. Look for unauthenticated access to /cache methods in LightLLM logs.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code on the affected system with the same privileges as the LightLLM service. This could lead to full system compromise, data theft, or disruption of service operations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected LightLLM versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade LightLLM to a patched version beyond 1.2.0. Disable RPyC cache service if not needed. Restrict network access to LightLLM ports using firewalls. Monitor for unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-103041. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70