Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads() without authentication or validation. A remote attacker who can reach the PD master can send a crafted payload to achieve arbitrary code execution.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-17 | 5 | Disclosure5 |
| 2026-02-19 | 1 | Patch1 |
CVE-2026-26220 Unauthenticated Remote Code Execution in LightLLM PD Disaggregation Mode https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26220
Post summary
A new unauthenticated remote code execution vulnerability (CVE-2026-26220) affecting LightLLM's PD Disaggregation Mode has been disclosed. No PoC, exploit details, or patch information are provided.
CVE-2026-26220 LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node exposes… https://www.cve.org/CVERecord?id=CVE-2026-26220
Post summary
LightLLM versions 1.1.0 and earlier have an unauthenticated RCE vulnerability in PD disaggregation mode, as detailed in the CVE record.
🚨New CVE Alert: CVE-2026-26220🚨 LightLLM v1.1.0 and earlier have a critical unauthenticated RCE flaw! 🌐💥 Attackers can exploit PD disaggregation mode via unvalidated WebSocket inputs to execute arbitrary code. Update now to stay safe! 🔒🛡️ #CyberSecurity #RCE #CVE2026-26220
Post summary
CVE-2026-26220 is a critical unauthenticated RCE flaw in LightLLM v1.1.0 and earlier that exploits PD disaggregation mode via unvalidated WebSocket inputs, and users are urged to update immediately.
🚨 CRITICAL RCE in ModelTC LightLLM ≤1.1.0! Unauthenticated attackers can exploit unsafe pickle deserialization over WebSockets for full system compromise. Restrict PD master node access & monitor now. Details: https://radar.offseq.com/threat/cve-2026-26220-cwe-502-deserializat... https://t.co/DGSNu6YHih
Post summary
The tweet discloses a critical RCE in ModelTC LightLLM via unsafe pickle deserialization and recommends restricting node access for mitigation.
⚡ New CVE Alert: CVE-2026-26220 📊 Severity: 9.3 🚨 Risk Level: Critical 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-26220 #CVE-2026-26220 #CVE #Critical #CyberSecurity #InfoSec https://t.co/ACOJ0pnLgR
Post summary
The tweet announces CVE-2026-26220 with a severity score of 9.3 and a critical risk level, affecting multiple unspecified products, but provides no exploit, patch, or PoC details.
🚨 CVE-2026-26220: LightLLM <= 1.1.0 PD Mode Unsafe... Classic Python pickle.loads() strike again—LightLLM PD mode blindly deserializes WebSocket frames without auth, giving ... https://zerodaysignal.com/vulnerability/CVE-2026-26220 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post discloses CVE-2026-26220 in LightLLM <=1.1.0, detailing an unsafe deserialization via WebSocket frames that could enable RCE, but it does not provide a PoC, exploit code, or evidence of active exploitation.