LightLLM CVE-2026-93839

Requires that the target run LightLLM (≤1.2.0) in PD (prefill-decode) disaggregated serving mode with the PD Master's /pd_register WebSocket endpoint network-reachable to the attacker; per CWE-306 and PR:N no credentials are needed and no user interaction is required, and the flaw is that peer-address validation is absent on node registration. Limiting factors: this endpoint exists only in the multi-node PD Master topology (not the default single-node deployment), so single-node or network-isolated deployments where the endpoint is firewalled off are not exposed - the practical constraint is endpoint reachability, not attacker privilege.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) describes a remotely reachable, unauthenticated, low-complexity flaw with high confidentiality, integrity, and availability impact, and this is consistent with the CWE-306 (Missing Authentication) classification and the described capabilities (prompt disclosure, node-replacement DoS, and SSRF to internal addresses). Unlike many kernel bugs where high vendor scores mask crash-only impact, here the impacts are real and multi-faceted: attacker-driven prompt exfiltration is a true confidentiality breach and SSRF into internal networks is a real integrity/pivot primitive. Signals are partially missing: there is no EPSS score, no CISA KEV listing, and no public POC in the provided data - so exploitation is currently 'no public exploit identified at time of analysis' despite the high score, suggesting the score reflects impact potential rather than confirmed in-the-wild activity. The main real-world discount is deployment-conditional: the vulnerable /pd_register endpoint lives in the PD (prefill-decode disaggregated) Master serving mode, which is a specific multi-node topology rather than LightLLM's default single-node deployment, so the population of exposed, vulnerable instances is smaller than the raw AV:N/PR:N vector implies. Verify exposure by checking whether the PD Master WebSocket endpoint is network-reachable.

An attacker who can reach a LightLLM PD Master's /pd_register WebSocket endpoint sends crafted JSON to register a rogue prefill/decode node without any authentication or peer-address validation. Once registered, user prompts get routed to the attacker's socket (disclosing sensitive prompt content), the attacker can evict legitimate nodes to cause denial of service, or coerce the PD Master into issuing requests to internal network addresses (SSRF). No public exploit code is identified in the provided data, but the VulnCheck advisory and GitHub issue #1576 document the flaw and pinpoint the vulnerable code paths.