External risk intelligence

LightLLM Unauthenticated RPyC Cache Service Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-103041

The vulnerability affects a cache service component in multimodal deployments that defaults to listening on all interfaces. As this service is a functional part of an LLM serving infrastructure, it is often exposed to the network to facilitate distributed communication between components, making it likely to be reachable in many standard deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in certain multimodal deployments of LightLLM, where an unauthenticated cache service is exposed. This service allows attackers to execute arbitrary code on the affected systems by sending specially crafted data. The primary concern is to confirm if this specific technology is in use within our environment and assess any potential exposure.

Unsecured cache service allows remote code execution.
Critical vulnerability in multimodal AI deployments.
Verify if this technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker can target a multimodal LightLLM deployment that exposes an unauthenticated RPyC cache service. By sending specially crafted serialized objects to this service, which has pickle deserialization enabled, an attacker can execute arbitrary code with the privileges of the service.

Service accessible from the network.
Unauthenticated cache service triggers vulnerability.
Arbitrary code execution with service privileges.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, multimodal deployments of LightLLM could allow unauthenticated attackers to execute arbitrary code with service privileges by sending crafted serialized objects to an exposed RPyC cache service. This could impact system data and service behavior.

System data and service behavior at risk.
Via unauthenticated RPyC cache service exposure.
Arbitrary code execution with service privileges.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for AI/ML platforms, infrastructure, and security should collaborate to address this critical vulnerability. The initial focus must be on discovering all instances of the affected service, assessing their network exposure and business criticality, and identifying the accountable system owners. A coordinated plan for remediation or risk reduction should then be developed based on this assessment.

Identify and confirm accountable system owners.
Verify service exposure and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LightLLM?

LightLLM is a high-performance Python-based library designed to serve Large Language Models (LLMs). It helps developers manage heavy AI workloads by optimizing memory usage and increasing inference speed. Specifically, it provides tools for multimodal deployments, which allow the system to process both text and images. This software typically serves as the engine behind AI-powered applications that require fast, scalable model performance.

What does CVE-2026-103041 mean for security?

This vulnerability is classified as CWE-502: Deserialization of Untrusted Data. The affected component uses the 'pickle' module to process incoming data. Because pickle can execute arbitrary code during the deserialization process, an attacker can send malicious, crafted objects to the service. The system will then automatically run this code, essentially granting the attacker full control over the service's functions.

How does an attacker trigger this RPyC cache bug?

The trigger requires the attacker to send a specially crafted serialized object directly to the RPyC cache service. Because the service defaults to an unauthenticated state and accepts these objects, no login or special privileges are needed to initiate the attack. Importantly, this bug is not triggered by standard, legitimate queries to the LLM itself, but rather by direct interaction with the specific cache service port.

Why should I worry about my LightLLM deployment?

Halo Surface Signal indicates that this cache service often defaults to listening on all available network interfaces to support distributed AI communication. This means that if your service is reachable over your network—and especially if it is internet-facing—it is likely exposed to this threat. Even internal services may be at risk if they are accessible to other compromised systems within your environment.

Do I need to check my systems for this service?

Yes. First, perform an inventory to locate where LightLLM is running in your environment, specifically looking for multimodal configurations. Once identified, determine if the cache service is active and confirm its network accessibility. Work with your infrastructure team to verify who owns these deployments so you can coordinate a plan to isolate the service or apply the necessary updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.