CVE-2026-93839

9.8 CRITICALpublic exploit available

Published 2026-09-18 · Updated 2026-09-22

AI risk analysis

Summary: LightLLM through 1.2.0 allows unauthenticated attackers to register arbitrary nodes via the /pd_register WebSocket endpoint, leading to potential full user prompt disclosure, denial of service, or internal network request issues.
Exploitability: Exploitation is relatively straightforward as it requires crafting a JSON payload without peer address validation. Attackers must have WebSocket access to the endpoint.
Blast radius: If exploited, the impact could be severe, affecting user privacy, system availability, and internal network security.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to LightLLM 1.2.1 or later.

auth-bypasswebwebsocketdenial-of-service

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-306

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.