CVE-2026-103041 Overview
CVE-2026-103041 is a critical unauthenticated remote code execution vulnerability in LightLLM through version 1.2.0. Multimodal deployments expose an RPyC cache service with Python pickle deserialization enabled and bound to all network interfaces. Attackers can send crafted serialized objects to exposed cache methods and execute arbitrary code with the privileges of the LightLLM service process. The flaw is tracked under CWE-502: Deserialization of Untrusted Data and carries a CVSS 4.0 base score of 9.3.
Critical Impact
Unauthenticated network attackers can achieve full remote code execution on any host running a vulnerable LightLLM multimodal deployment, compromising model servers, training data, and cloud credentials.
Affected Products
- LightLLM through version 1.2.0
- LightLLM multimodal deployments using the embed_cache RPyC service
- Any downstream inference service embedding LightLLM <= 1.2.0
Discovery Timeline
- 2026-09-29 - CVE-2026-103041 published to NVD
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-103041
Vulnerability Analysis
LightLLM is an open-source large language model inference and serving framework maintained by ModelTC. In multimodal deployments, LightLLM starts an embedding cache manager that exposes an RPyC (Remote Python Call) endpoint to coordinate cached embedding lookups between worker processes. According to the VulnCheck advisory, this service is bound to all interfaces without authentication and permits pickle-based object exchange.
Any attacker able to reach the service port can invoke cache methods that deserialize attacker-supplied objects. Python's pickle module executes arbitrary callables during deserialization, granting code execution inside the LightLLM process. Impact typically includes theft of model weights, exfiltration of prompts and responses, cloud credential compromise, and lateral movement within GPU inference clusters.
Root Cause
The root cause is unsafe use of Python pickle deserialization on data received from untrusted network sources. The embed_cache/manager.py module in LightLLM v1.2.0 starts an RPyC server that accepts serialized objects on cache methods without authentication, transport encryption, or input validation. See the manager.py source for the exposed service definition.
Attack Vector
Exploitation requires only network reachability to the RPyC cache port on a vulnerable LightLLM host. An attacker connects to the exposed service and invokes a cache method with a crafted pickle payload containing a __reduce__ gadget. Deserialization triggers execution of the attacker-controlled callable in the LightLLM service context. No credentials, user interaction, or prior foothold are required. Refer to the VulnCheck advisory and GitHub Issue #1596 for technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-103041
Indicators of Compromise
- Unexpected child processes such as sh, bash, python, or curl spawned by the LightLLM inference process.
- Outbound network connections from LightLLM hosts to unknown IPs shortly after inbound traffic on the RPyC cache port.
- Modifications to model directories, cache files, or startup scripts owned by the LightLLM service account.
- New cron jobs, systemd units, or SSH keys created under the LightLLM user context.
Detection Strategies
- Inspect listening sockets on inference nodes for RPyC services bound to 0.0.0.0 on non-loopback interfaces.
- Alert on process lineage where the LightLLM Python worker executes shells, package managers, or network utilities.
- Correlate inbound TCP connections to the cache service port with subsequent egress traffic from the same host.
Monitoring Recommendations
- Enable network flow logging on GPU inference subnets and baseline expected talkers to the LightLLM cache port.
- Monitor Python runtime telemetry for pickle.loads calls handling network-sourced buffers in inference services.
- Ingest host process, network, and file telemetry into a centralized data lake to correlate exploitation chains across nodes.
How to Mitigate CVE-2026-103041
Immediate Actions Required
- Block external and cross-tenant network access to the LightLLM RPyC cache port at the host firewall and cloud security group level.
- Restrict LightLLM multimodal deployments to trusted management networks and disable public exposure of inference infrastructure.
- Run LightLLM under a dedicated low-privilege service account without cloud metadata or credential access.
- Audit LightLLM hosts for signs of prior exploitation using the indicators above.
Patch Information
At the time of publication, no fixed release is referenced in the NVD entry for versions after 1.2.0. Track the LightLLM GitHub repository and Issue #1596 for upstream remediation. Until a patched release is available, treat all LightLLM <= 1.2.0 deployments as vulnerable and apply compensating controls.
Workarounds
- Bind the RPyC cache service to 127.0.0.1 only and require workers to connect over the loopback interface.
- Place LightLLM behind an authenticated reverse proxy or service mesh that enforces mutual TLS between inference components.
- Disable the multimodal embedding cache path if not required for the deployment.
- Apply container network policies or Kubernetes NetworkPolicy objects to isolate LightLLM pods from untrusted namespaces.
# Example iptables rule limiting RPyC cache access to localhost only
iptables -A INPUT -p tcp --dport 2233 ! -s 127.0.0.1 -j DROP
iptables -A INPUT -p tcp --dport 2233 -s 127.0.0.1 -j ACCEPT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
