# CVE-2026-26220: ModelTC LightLLM remote code execution in PD WebSocket endpoints

Source: https://junglewise.ai/threats/cve-2026-26220-modeltc-lightllm-remote-code-execution-in-pd-websocket-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-17. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-26220 · Severity: info · CVSS 9.3 · Published 2026-02-17

LightLLM is a framework used to deploy and run large language models (LLMs). A security flaw in its distributed processing mode allows an unauthenticated attacker to remotely execute arbitrary commands on the server. This could lead to a total system takeover, theft of sensitive AI models, or access to customer data processed by the engine.

Technologies: [ModelTC LightLLM](https://junglewise.ai/threats/technologies/lightllm). Vendors: [ModelTC](https://junglewise.ai/threats/vendors/modeltc).

## Quick answers

**Is CVE-2026-26220 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26220 being exploited in the wild.

**How severe is CVE-2026-26220?** Informational severity, with a CVSS score of 9.3, published 17 February 2026.

**Which products and versions are affected?** ModelTC LightLLM <= 1.1.0.

**Is there a fix for CVE-2026-26220?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-26220 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-26220?** Check whether you run ModelTC LightLLM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A critical remote code execution vulnerability exists in LightLLM's PD (prefill-decode) disaggregation mode due to the use of the unsafe 'pickle.loads()' function on untrusted data. The PD master node exposes WebSocket endpoints, specifically '/pd_register' and '/kv_move_status', which accept binary frames and deserialize them without any authentication or validation. Because the application explicitly prevents binding to localhost in this mode, these endpoints are network-exposed by design. An attacker can send a crafted pickle payload to these endpoints to achieve arbitrary code execution with the privileges of the application process. As of the advisory date, the issue remains unpatched in version 1.1.0.

## Affected products

- ModelTC LightLLM <= 1.1.0

## Timeline

- 2025-03: other: Similar deserialization issue reported via ZMQ (#784)
- 2026-02-11: disclosed: Vulnerability discovered and confirmed by researcher
- 2026-02-12: other: CVE-2026-26220 assigned
- 2026-02-15: advisory: Public disclosure via GitHub issue #1213
- 2026-02-17: other: NVD publication date

## References

- [https://chocapikk.com/posts/2026/lightllm-pickle-rce/](https://chocapikk.com/posts/2026/lightllm-pickle-rce/)
- [https://github.com/ModelTC/LightLLM/issues/1213](https://github.com/ModelTC/LightLLM/issues/1213)
- [https://github.com/ModelTC/lightllm/blob/a27dfc88c2144ed51a6e160b6fbe20aad66c8fe0/lightllm/server/api_http.py](https://github.com/ModelTC/lightllm/blob/a27dfc88c2144ed51a6e160b6fbe20aad66c8fe0/lightllm/server/api_http.py)
- [https://github.com/ModelTC/lightllm/blob/a27dfc88c2144ed51a6e160b6fbe20aad66c8fe0/lightllm/server/api_http.py](https://github.com/ModelTC/lightllm/blob/a27dfc88c2144ed51a6e160b6fbe20aad66c8fe0/lightllm/server/api_http.py)
- [https://lightllm-en.readthedocs.io/en/latest/index.html](https://lightllm-en.readthedocs.io/en/latest/index.html)
- [https://www.vulncheck.com/advisories/lightllm-pd-mode-unsafe-deserialization-rce](https://www.vulncheck.com/advisories/lightllm-pd-mode-unsafe-deserialization-rce)

## Related threats

- [LightLLM denial of service via pd_kv_trans_params unpickling](https://junglewise.ai/threats/cve-2026-111160-lightllm-through-1-2-0-contains-a-denial-of-service)
- [LightLLM visual_only unauthenticated RCE via RPyC pickle deserialization](https://junglewise.ai/threats/cve-2026-103395-lightllm-through-1-2-0-visual-only-deployments-expose-an)
- [LightLLM authentication bypass in reinforcement learning control API](https://junglewise.ai/threats/cve-2026-103270-lightllm-through-1-2-0-mounts-reinforcement-learning-control)
- [LightLLM server-side request forgery in multimodal endpoints](https://junglewise.ai/threats/cve-2026-103243-lightllm-through-1-2-0-fails-to-validate-image-url-and-audio-url)
- [LightLLM memory exhaustion in NCCL control channel](https://junglewise.ai/threats/cve-2026-103042-lightllm-through-1-2-0-contains-a-memory-exhaustion)