LightLLM Config Server Has Unauthenticated RCE

LightLLM, the open-source inference framework from ModelTC, has a critical remote code execution vulnerability in its Config Server component. No authentication is required to trigger it.

The vulnerability is tracked as CVE-2026-90919 and carries a CVSS score of 9.8 (critical), as assigned by NIST’s National Vulnerability Database. The affected component is the /visual_register WebSocket endpoint in the LightLLM Config Server, which accepts incoming frames and passes them to Python’s pickle.loads without validating or authenticating the sender.

Pickle deserialization is a well-documented Python vulnerability class. When attacker-controlled data reaches pickle.loads, crafted payloads can execute arbitrary code on the host. The LightLLM Config Server does not gate this endpoint behind any authentication, so any attacker with network access to the port can send a payload.

The vulnerable code is visible in the ModelTC/LightLLM repository at tag v1.2.0. All versions through v1.2.0 are confirmed affected.

Who is exposed

Any LightLLM deployment running v1.2.0 or earlier where the Config Server is reachable from an untrusted network. The Config Server manages distributed inference; some deployments bind it to all network interfaces rather than a restricted address.

Check your environment: if the Config Server port is accessible outside a trusted network boundary, the host should be treated as exposed to this vulnerability.

What to do

Update LightLLM. ModelTC’s GitHub repository carries current release tags with the fix. Review the NVD entry for confirmed patch version details as they are finalized.

If an immediate update is not possible: bind the Config Server to 127.0.0.1 or a private network address and block external access to that port at the firewall level. That removes the network-accessible attack surface while you schedule the update.

The LightLLM team has not issued a standalone security advisory as of September 16, 2026. The NVD record and the repository commit history are the primary sources for tracking the fix.

AI inference frameworks deployed in production environments increasingly carry this class of flaw: unauthenticated network endpoints that trust caller-supplied data. If LightLLM’s Config Server is exposed in your environment, patch it. If you are deploying other AI inference tooling, audit what ports those components open and whether authentication is enforced before any data processing.