CVE-2026-103270

Summary

LightLLM 1.2.0 and earlier allows unauthenticated access to critical reinforcement learning control endpoints that can halt inference operations and wedge workers, enabling disruption of AI model serving without any authentication.

Exploitability

Easy to exploit with no preconditions; attackers only need to send HTTP requests to the exposed control endpoints like /pause_generation or /abort_request to disrupt services.

Blast radius

Affects deployments using --enable_rl flag where attackers can halt inference operations, potentially causing service disruption and resource exhaustion across multiple workers in a LightLLM deployment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to 1.2.1 or later to receive the fix for authentication checks on reinforcement learning control routes.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.