Overview
CVE-2026-96560 is a critical remote code execution vulnerability in LightLLM, a popular open-source framework for large language models. The vulnerability affects LightLLM version 1.2.0 and earlier, exposing an unauthenticated RPyC (Remote Python Call) control channel. This channel allows attackers to send malicious pickled objects, which are then deserialized and executed with the privileges of the LightLLM service account.
Understanding the Vulnerability / Threat
Root Cause Analysis
The root cause of CVE-2026-96560 is a design and implementation flaw in the KV-transfer worker of LightLLM. Specifically, when the worker is started with the `--pd_trans_mode nccl` option, it exposes an unauthenticated RPyC control channel. This channel uses the RPyC ThreadedServer, which deserializes attacker-supplied data without proper authentication or authorization checks.
This vulnerability belongs to the CWE-502 category, which involves the deserialization of untrusted data. The CWE-502 weakness is particularly dangerous because it can lead to remote code execution, allowing attackers to execute arbitrary code on the affected system.
Attack Surface & Vector
The attack surface for CVE-2026-96560 is the network-exposed RPyC control channel. An attacker can reach this channel remotely without any authentication or authorization. The preconditions for exploitation are:
1. The LightLLM service is running with the `--pd_trans_mode nccl` option.
2. The RPyC control channel is exposed on a network-accessible interface.
Exploitation Mechanics — Scenario Walkthrough
Scenario: Compromising a Corporate LightLLM Instance
1. Initial Position: An attacker gains access to the corporate network, either through a phishing campaign or by exploiting a separate vulnerability.
2. Triggering the Flaw: The attacker discovers the exposed RPyC control channel and crafts a malicious pickled object that, when deserialized, executes arbitrary code on the LightLLM server.
3. What Breaks: The RPyC ThreadedServer deserializes the malicious pickled object, executing the attacker's code with the privileges of the LightLLM service account. This bypasses security boundaries, allowing the attacker to execute system-level commands.
4. Attacker's Prize: The attacker gains remote code execution capabilities, allowing them to move laterally within the network, exfiltrate sensitive data, or deploy ransomware.
Real-World Impact
The impact of CVE-2026-96560 can be severe. An attacker can use this vulnerability to:
* Execute arbitrary code on the affected system
* Move laterally within the network
* Exfiltrate sensitive data
* Deploy ransomware or other types of malware
Detection & Defense
Immediate Mitigations
To address CVE-2026-96560, defenders should:
1. Upgrade LightLLM to version 1.2.1 or later.
2. Disable the `--pd_trans_mode nccl` option if not required.
3. Restrict network access to the RPyC control channel.
Detection Strategies
Defenders can detect exploitation attempts by:
1. Monitoring network traffic for suspicious RPyC activity.
2. Implementing SIEM rules to detect deserialization attempts.
3. Using MITRE ATT&CK techniques, such as T1216 (Remote Access Tools) and T1059 (Command and Scripting Interpreter).
Long-Term Hardening
To prevent similar vulnerabilities, defenders should:
1. Implement secure deserialization practices.
2. Use authentication and authorization mechanisms for remote control channels.
3. Regularly update and patch dependencies.
Key Takeaways
* CVE-2026-96560 is a critical remote code execution vulnerability in LightLLM.
* The vulnerability exposes an unauthenticated RPyC control channel, allowing attackers to execute arbitrary code.
* Defenders should upgrade to version 1.2.1 or later, disable the `--pd_trans_mode nccl` option, and restrict network access.
* Detection strategies include monitoring network traffic, implementing SIEM rules, and using MITRE ATT&CK techniques.
Sources
* National Vulnerability Database (NVD) - CVE-2026-96560