by Kastro
Paper/Archive/CVE-2026-103041

CVE-2026-103041

ModelTC LightLLM — LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service

EPSS 0.8%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.6.556 × 2011.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges.

Affected

ProductAffectedFixed inSource
LightLLM≤ 1.2.0–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/ModelTC/LightLLM/issues/1596writeupgithub.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/embed_cache/manager.py#L29-L31writeupgithub.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/embed_cache/manager.py#L66refgithub.com/ModelTC/LightLLMwriteupvulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-remote-code-execution-via-embed-cache-rpyc-service