CVE-2026-26220: Modeltc Lightllm

Critical severity, CVSS 9.3. EPSS: 1.7% chance of exploitation in the next 30 days.

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads() without authentication or validation. A remote attacker who can reach the PD master can send a crafted payload to achieve arbitrary code execution.

Affected products

• Modeltc Lightllm: up to and including 1.1.0

Published 2026-02-17. Last modified 2026-07-14.