CVE-2026-103040

Summary

LightLLM versions through 1.2.0 are vulnerable to remote code execution due to an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code via crafted serialized objects.

Exploitability

Exploitation is relatively straightforward given the unauthenticated nature and the presence of a RPyC server with deserialization enabled. Attackers must start the service with the --enable_profiling flag.

Blast radius

If exploited, this vulnerability could lead to complete compromise of the affected system, potentially allowing attackers to execute arbitrary code and gain full control over the system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the profiling feature by not starting the service with the --enable_profiling flag, or upgrade to a version later than 1.2.0 if available.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.