# CVE-2026-103395: LightLLM visual_only unauthenticated RCE via RPyC pickle deserialization

Source: https://junglewise.ai/threats/cve-2026-103395-lightllm-through-1-2-0-visual-only-deployments-expose-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-103395 · Severity: critical · CVSS 9.8 · Published 2026-09-30

LightLLM is a framework for serving large language models with visual/multimodal capabilities. In visual-only deployment mode, it exposes an unauthenticated RPyC service that deserializes untrusted data, allowing any network attacker to execute arbitrary code on the server with the privileges of the LightLLM service account. This gives complete control over the preprocessing server and any credentials or resources it can access.

Technologies: [ModelTC LightLLM](https://junglewise.ai/threats/technologies/lightllm). Vendors: [ModelTC](https://junglewise.ai/threats/vendors/modeltc).

## Quick answers

**Is CVE-2026-103395 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103395 being exploited in the wild.

**How severe is CVE-2026-103395?** Critical severity, with a CVSS score of 9.8, published 30 September 2026.

**Which products and versions are affected?** ModelTC LightLLM through 1.2.0.

**Is there a fix for CVE-2026-103395?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103395 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103395?** Check whether you run ModelTC LightLLM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is unsafe deserialization (CWE-502) combined with missing authentication (CWE-306). The visual_only_manager.py starts an RPyC ThreadedServer with allow_pickle enabled, no authentication, and listening on 0.0.0.0. The exposed_remote_infer_images() method calls obtain() on attacker-supplied arguments, which deserializes pickled objects; an attacker sends a pickled object with a __reduce__ gadget to achieve RCE before the method validates input as a list.

## Affected products

- ModelTC LightLLM through 1.2.0

## Timeline

- 2026-09-30: disclosed

## References

- [https://github.com/ModelTC/LightLLM](https://github.com/ModelTC/LightLLM)
- [https://github.com/ModelTC/LightLLM/issues/1610](https://github.com/ModelTC/LightLLM/issues/1610)

## Related threats

- [LightLLM denial of service via pd_kv_trans_params unpickling](https://junglewise.ai/threats/cve-2026-111160-lightllm-through-1-2-0-contains-a-denial-of-service)
- [LightLLM authentication bypass in reinforcement learning control API](https://junglewise.ai/threats/cve-2026-103270-lightllm-through-1-2-0-mounts-reinforcement-learning-control)
- [LightLLM server-side request forgery in multimodal endpoints](https://junglewise.ai/threats/cve-2026-103243-lightllm-through-1-2-0-fails-to-validate-image-url-and-audio-url)
- [LightLLM memory exhaustion in NCCL control channel](https://junglewise.ai/threats/cve-2026-103042-lightllm-through-1-2-0-contains-a-memory-exhaustion)
- [LightLLM multimodal pickle deserialization in RPyC cache service](https://junglewise.ai/threats/cve-2026-103041-lightllm-through-1-2-0-multimodal-deployments-expose-an)