CVE-2026-96560: LightLLM RCE Vulnerability

CVE-2026-96560 Overview

CVE-2026-96560 is an unauthenticated remote code execution vulnerability in LightLLM versions through 1.2.0. The flaw exists in the KV-transfer worker when the server is launched with the --pd_trans_mode nccl flag. In this mode, LightLLM exposes an RPyC ThreadedServer control channel that deserializes attacker-supplied data without authentication. An attacker who reaches the exposed RPyC port can send crafted pickled objects and execute arbitrary code with the privileges of the LightLLM service account. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data.

Critical Impact

Unauthenticated network attackers can achieve full remote code execution on LightLLM inference nodes, compromising the model server host and any co-located GPU workloads.

Affected Products

• LightLLM (ModelTC) versions up to and including 1.2.0
• Deployments started with the --pd_trans_mode nccl KV-transfer option
• Any host exposing the LightLLM RPyC control port on a reachable network interface

Discovery Timeline

• 2026-09-23 - CVE-2026-96560 published to the National Vulnerability Database
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96560

Vulnerability Analysis

LightLLM is a Python-based large language model inference and serving framework. When operators enable prefill/decode disaggregation with NCCL as the KV-cache transport, LightLLM starts a helper worker that coordinates KV-cache movement between prefill and decode instances. This helper worker uses RPyC, a remote Python call library that transports objects using Python's pickle protocol by default.

The worker instantiates an RPyC ThreadedServer bound to a network-accessible interface and does not enforce authentication, transport encryption, or object filtering. Any client that connects to the exposed port participates in a trusted RPyC session. Because pickle deserialization can invoke arbitrary callables through __reduce__, an attacker who submits a crafted pickle stream triggers code execution inside the LightLLM process.

Root Cause

The root cause is unsafe deserialization of untrusted input [CWE-502]. The nccl_kv_transporter module exposes the RPyC control channel without an authenticator callback and relies on the default pickle-based protocol. See the affected code paths in nccl_kv_transporter.py L247-L249 and nccl_kv_transporter.py L437-L461.

Attack Vector

Exploitation requires network reachability to the RPyC port opened by the KV-transfer worker. The attacker opens an RPyC connection and delivers a pickle payload whose __reduce__ method resolves to a system command or Python callable. LightLLM deserializes the object and executes the embedded logic in the context of the service account. No credentials, tokens, or user interaction are required. Further technical detail is available in the VulnCheck advisory for LightLLM and GitHub Issue #1590.

Detection Methods for CVE-2026-96560

Indicators of Compromise

• Unexpected outbound network connections originating from the LightLLM Python process, particularly to attacker-controlled infrastructure.
• Child processes such as /bin/sh, bash, curl, wget, or Python subprocesses spawned by the LightLLM worker.
• New or modified files in the model server working directory, cron entries, or SSH authorized_keys written by the service account.
• RPyC session activity from source IPs outside the expected inference cluster subnet.

Detection Strategies

• Inventory LightLLM deployments and identify any instance started with --pd_trans_mode nccl, then verify whether the RPyC port is reachable outside the inference fabric.
• Alert on process lineage where the LightLLM Python interpreter forks shell or scripting interpreters, which is atypical for inference workloads.
• Inspect network flow logs for unauthenticated TCP sessions to RPyC ports on GPU nodes.

Monitoring Recommendations

• Capture EDR telemetry for the LightLLM service account and baseline expected child processes and outbound destinations.
• Forward Python application logs and host authentication logs to a centralized data lake for correlation across GPU nodes.
• Monitor for creation of persistence artifacts such as systemd units, cron jobs, or SSH keys on inference hosts.

How to Mitigate CVE-2026-96560

Immediate Actions Required

• Restrict network exposure of the RPyC KV-transfer port to loopback or a dedicated, isolated inference network segment using host firewalls or Kubernetes NetworkPolicies.
• Stop running LightLLM with --pd_trans_mode nccl on hosts where the RPyC port is reachable from untrusted networks until a fix is deployed.
• Run the LightLLM process under a dedicated low-privilege service account to limit blast radius if the deserialization primitive is triggered.
• Audit inference nodes for the indicators of compromise listed above.

Patch Information

At time of publication, no fixed release has been referenced in the NVD entry for LightLLM. Track GitHub Issue #1590 and the LightLLM repository for upstream remediation. Upstream fixes for this class of issue typically add an RPyC authenticator, replace the pickle protocol with a safer schema, or bind the control channel to a UNIX domain socket.

Workarounds

• Disable the NCCL PD transfer mode and use an alternative KV-transfer backend that does not open an unauthenticated RPyC channel.
• Place the RPyC port behind a mutual TLS reverse proxy or SSH tunnel and enforce allow-listed peers at the network layer.
• Deploy LightLLM inside a container with an egress-restricted network policy so any successful exploitation cannot reach external command-and-control infrastructure.

# Example host firewall restriction limiting RPyC access to a trusted inference subnet
# Replace 10.10.0.0/24 with the actual inference fabric CIDR and 18861 with the RPyC port in use
iptables -A INPUT -p tcp --dport 18861 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 18861 -j DROP