Critical severity9.8NVD Advisory· Published Sep 29, 2026· Updated Sep 29, 2026
CVE-2026-103041
CVE-2026-103041
Description
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/ModelTC/LightLLM/issues/1596nvd
- github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/embed_cache/manager.pynvd
- github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/embed_cache/manager.pynvd
- www.vulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-remote-code-execution-via-embed-cache-rpyc-servicenvd
News mentions
0No linked articles in our index yet.