CVE-2026-103270: Modeltc Lightllm

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference operations and wedge workers on deployments started with --enable_rl.

Affected products

• Modeltc Lightllm: up to and including 1.2.0

Published 2026-09-30. Last modified 2026-09-30.