External risk intelligence

LightLLM Unauthenticated Remote Code Execution via Unsafe Deserialization in Prefill-Decode Mode.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-26220

The vulnerability exists in the PD master node's WebSocket endpoints within a LLM serving framework. While these nodes manage model disaggregation and are often positioned within internal clusters or infrastructure, they may be exposed in some deployments to handle external requests, though they are not typically designed as public-facing gateways by default.

Deserialization

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in LightLLM's prefill-decode disaggregation mode, allowing unauthenticated attackers to execute arbitrary code remotely. This issue arises from the direct use of unvalidated, untrusted data in a critical function, posing a significant risk if these specific nodes are accessible from the network. The main concern is to determine if our environment utilizes this mode and if those master nodes are exposed to potential attackers.

Unauthenticated code execution risk in specific mode.
Affects model disaggregation and data processing.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted binary data over WebSocket to the PD master node. This node handles disaggregated model components and is reachable remotely. The vulnerability lies in its direct use of `pickle.loads()` on incoming data without proper checks, allowing an attacker to execute arbitrary code on the system.

Entry condition: Attacker can reach PD master node.
Trigger point: Send crafted binary frames to WebSocket.
Resulting risk: Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the PD master node by sending a crafted payload over WebSocket. This could impact the availability and integrity of the service.

System code execution.
Unauthenticated network access.
Service disruption and compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the PD master node of LightLLM, which handles model disaggregation. In typical deployments, these nodes operate within internal infrastructure or clusters. The first practical step is to determine if these PD master nodes are reachable externally or accessible from untrusted internal segments, and to identify the owning team responsible for the LightLLM deployment and its associated infrastructure.

Identify owning team for LightLLM deployment.
Verify reachability of PD master nodes.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LightLLM and its PD disaggregation mode?

LightLLM is a framework designed for serving Large Language Models efficiently. Its prefill-decode (PD) disaggregation mode splits model tasks across different components to improve performance. In this architecture, a PD master node coordinates these tasks, acting as a central manager for the distributed model workload.

Why is CVE-2026-26220 considered a critical weakness?

This vulnerability is classified as CWE-502, which involves unsafe deserialization. The system uses the 'pickle' module to process incoming data from the network without verifying it first. Because pickle can be instructed to run arbitrary commands, an attacker can send malicious binary data that the master node automatically executes, leading to a full system compromise.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specially crafted binary frame to the PD master node's WebSocket endpoint. This action does not require any credentials or previous authentication. If the node is not using the PD disaggregation mode or is configured to block raw WebSocket traffic from untrusted sources, this specific attack path is not applicable.

Do I need to worry about this vulnerability in my network?

Per Halo Surface Signal, you should prioritize this if your PD master nodes are reachable from your network edge. While these components are often meant for internal clustering, configurations vary. If your infrastructure allows these nodes to receive traffic from outside the trusted perimeter, the risk of unauthenticated access increases significantly.

What is the first step to address CVE-2026-26220?

Begin by auditing your LightLLM deployments to confirm if you are utilizing the PD disaggregation mode. Locate the teams responsible for these services, check the network accessibility of your PD master nodes, and ensure they are not exposed to external or untrusted segments while you evaluate your specific environment's risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.