A single advisory describes a critical missing-authentication flaw in LightLLM's /pd_register WebSocket endpoint that would let unauthenticated attackers register rogue nodes, siphon full user prompts, and knock legitimate workers offline. The record has not yet been analyzed by NVD, so the details below should be read as the reporter's claims rather than independently corroborated findings.
What Is It
According to the advisory, LightLLM through version 1.2.0 contains an authentication bypass in the /pd_register WebSocket endpoint exposed by the PD Master component. The endpoint is described as accepting crafted JSON node registrations without validating the peer address, which would allow any network-reachable attacker to enroll an arbitrary node into the serving cluster. The weakness is classified as CWE-306 (Missing Authentication for Critical Function). The reporting source assigned a CVSS 3.1 base score of 9.8 (CRITICAL, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a secondary CVSS 4.0 score of 9.3 (CRITICAL). These scores are the reporter's, not NVD-assigned, and may change once the record is analyzed.
Why It Matters
If the described behavior holds, registration is the trust boundary and there is no check on it. The advisory attributes three impacts to a successful rogue registration:
- Prompt disclosure. Full user prompts would be routed to the attacker's socket; in an LLM inference deployment, that is the most sensitive data in transit.
- Denial of service. An attacker could replace legitimate nodes, disrupting availability of the inference service.
- Internal network requests. The PD Master could be induced to issue requests to internal network addresses, giving an outside attacker a pivot into otherwise unreachable infrastructure.
The reporter's vector assumes no user interaction, no privileges, and low attack complexity over the network, with the full triad of confidentiality, integrity, and availability rated HIGH. No public proof-of-concept or third-party reproduction accompanies the advisory in the supplied data, and real-world impact will depend on whether the PD Master endpoint is reachable beyond a trusted network segment; in many deployments it may not be.
What's Vulnerable
- Vendor: ModelTC
- Product: LightLLM (
pkg:github/ModelTC/lightllm) - Affected versions: all versions up to and including 1.2.0 (semver,
<= 1.2.0), per the advisory; the range has not been vendor-confirmed in the supplied data
The code paths cited by the reporter are in lightllm/server/api_http.py, lightllm/server/api_http_pd.py, and lightllm/server/httpserver_for_pd_master/manager.py at tag v1.2.0.
Patch Status
The supplied NVD record lists no fixed version and no vendor patch reference; the CVE was published 2026-09-18 with a vulnerability status of "Received," meaning it is awaiting NVD analysis and its contents may be revised or disputed. Tracking for the issue is at ModelTC/LightLLM issue #1576; the supplied data does not indicate a vendor response there. There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed and no KEV remediation deadline applies.
Operators running LightLLM 1.2.0 or earlier with a PD Master deployment can reduce exposure in the interim by restricting network reachability of the /pd_register endpoint to trusted hosts while the record is validated and a vendor fix is confirmed.
Sources
- NVD, CVE-2026-93839
- VulnCheck Advisory; LightLLM through 1.2.0 missing authentication in PD Master /pd_register WebSocket endpoint
- ModelTC/LightLLM, GitHub repository
- ModelTC/LightLLM, Issue #1576
- api_http.py L198-L205 (v1.2.0)
- api_http_pd.py L26-L36 (v1.2.0)
- httpserver_for_pd_master/manager.py L714-L749 (v1.2.0)