LightLLM Config Server Unauthenticated RCE via Pickle Deserialization
LightLLM through v1.2.0 passes unauthenticated WebSocket frames to pickle.loads in the Config Server, enabling remote code execution on any exposed instance.
- Vendor
- ModelTC
- Product
- LightLLM
- CVSS
- 9.8
- EPSS (exploit probability)
- 1.1%
- Status
- patched
- Published
Is CVE-2026-90919 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-90919 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-11 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.1% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-11. Full cross-catalog view: /kev-comparison
CVE-2026-90919 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The Config Server in LightLLM through v1.2.0 exposes a /visual_register WebSocket endpoint that passes incoming frames to pickle.loads with no authentication or input validation. Pickle deserialization of attacker-controlled data executes arbitrary code on the host.
Affected: LightLLM through v1.2.0. The Config Server is a distributed inference management component.
Fix: Update to the latest release. ModelTC’s GitHub repository is the authoritative source for patched versions.
Interim mitigation: Bind the Config Server to localhost or a private network interface and block external access to the port at the firewall until an update can be applied.
