CVE-2026-103040CWE-502insecure-deserialization

CVE-2026-103040

Critical · published September 30, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
55.5
In the wild
Unconfirmed
What it is

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted serialized objects to the profiler command queue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00781 · 55.5th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-09-30T03:17Z
References (6)
https://github.com/ModelTC/LightLLM · [email protected]https://github.com/ModelTC/LightLLM/issues/1597 · [email protected]https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/profiler_service.py#L32-L34 · [email protected]https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/profiler_service.py#L46-L50 · [email protected]https://www.vulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-remote-code-execution-via-router-profiler-rpyc-service · [email protected]https://github.com/ModelTC/LightLLM/issues/1597 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 1%
    epss
  • 29 SEP 22:51Z
    LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service
    cvelistv5