CVE-2026-103270CWE-306

CVE-2026-103270

High · published September 30, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.9
In the wild
Unconfirmed
What it is

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference operations and wedge workers on deployments started with --enable_rl.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00513 · 42.9th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-30T19:22Z
References (6)
https://github.com/ModelTC/LightLLM · [email protected]https://github.com/ModelTC/LightLLM/issues/1609 · [email protected]https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_http.py#L505-L507 · [email protected]https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_http_rl.py#L51-L139 · [email protected]https://www.vulncheck.com/advisories/lightllm-through-1.2.0-missing-authentication-on-rl-control-routes · [email protected]https://github.com/ModelTC/LightLLM/issues/1609 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 30 SEP 14:48Z
    LightLLM through 1.2.0 Missing Authentication on RL Control Routes
    cvelistv5