Is CVE-2026-26220 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26220 being exploited in the wild.

How severe is CVE-2026-26220?

Informational severity, with a CVSS score of 9.3, published 17 February 2026.

Is there a fix for CVE-2026-26220?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-26220 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-26220?

Check whether you run ModelTC LightLLM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26220: ModelTC LightLLM remote code execution in PD WebSocket endpoints

CVE-2026-26220 · Severity: info · CVSS 9.3 · Published 2026-02-17

LightLLM is a framework used to deploy and run large language models (LLMs). A security flaw in its distributed processing mode allows an unauthenticated attacker to remotely execute arbitrary commands on the server. This could lead to a total system takeover, theft of sensitive AI models, or access to customer data processed by the engine.

Technologies: ModelTC LightLLM. Vendors: ModelTC.

Quick answers

Is CVE-2026-26220 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26220 being exploited in the wild.
How severe is CVE-2026-26220?: Informational severity, with a CVSS score of 9.3, published 17 February 2026.
Which products and versions are affected?: ModelTC LightLLM <= 1.1.0.
Is there a fix for CVE-2026-26220?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-26220 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-26220?: Check whether you run ModelTC LightLLM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A critical remote code execution vulnerability exists in LightLLM's PD (prefill-decode) disaggregation mode due to the use of the unsafe 'pickle.loads()' function on untrusted data. The PD master node exposes WebSocket endpoints, specifically '/pd_register' and '/kv_move_status', which accept binary frames and deserialize them without any authentication or validation. Because the application explicitly prevents binding to localhost in this mode, these endpoints are network-exposed by design. An attacker can send a crafted pickle payload to these endpoints to achieve arbitrary code execution with the privileges of the application process. As of the advisory date, the issue remains unpatched in version 1.1.0.

Affected products

ModelTC LightLLM <= 1.1.0

Timeline

2025-03: other: Similar deserialization issue reported via ZMQ (#784)
2026-02-11: disclosed: Vulnerability discovered and confirmed by researcher
2026-02-12: other: CVE-2026-26220 assigned
2026-02-15: advisory: Public disclosure via GitHub issue #1213
2026-02-17: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.