CVE-2026-96560
Last modified
CVE-2026-96560 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC ThreadedServer to execute arbitrary code with the privileges of the LightLLM service account..
Description
LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC ThreadedServer to execute arbitrary code with the privileges of the LightLLM service account.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| ModelTC | LightLLM | <= 1.2.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-96560?
How severe is CVE-2026-96560?
How do I fix CVE-2026-96560?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-96553Improper Neutralization of Input During Web Page Generation …7.1
- CVE-2026-96554The BuddyBoss Platform plugin for WordPress is vulnerable to…6.4
- CVE-2026-96556A flaw has been found in Neethuharii CafeManagement. Affecte…7.3
- CVE-2026-96558The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker…7.2
- CVE-2026-96559Rejected reason: This ID was for testing
- CVE-2026-9656The HubSpot All-In-One Marketing – Forms, Popups, Live Chat …4.3
- CVE-2026-96561The AI Engine – The Chatbot, AI Framework & MCP for WordPres…7.2
- CVE-2026-96562The The Broken Link Checker plugin for WordPress is vulnerab…6.5
- CVE-2026-96563The Motors – Car Dealership & Classified Listings Plugin plu…6.4
- CVE-2026-96564The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPr…7.2
- CVE-2026-96565The WP-Members Membership Plugin plugin for WordPress is vul…6.4
- CVE-2026-96566The Newsletter – Send awesome emails from WordPress plugin f…7.2
Are you affected by CVE-2026-96560?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST