---
id: CVE-2026-93839
title: >-
  LightLLM through 1.2.0 contains an authentication bypass vulnerability in the
  /pd_register WebSocket endpoint that allows unauthenticated attackers to
  register arbitrary nodes by supplying crafted JSON without peer address
  validation
summary: >-
  LightLLM through 1.2.0 contains an authentication bypass vulnerability in the
  /pd_register WebSocket endpoint that allows unauthenticated attackers to
  register arbitrary nodes by supplying crafted JSON without peer address
  validation. At…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: ModelTC
product: LightLLM
affected:
  - LightLLM <= 1.2.0
published: '2026-09-18'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:55:25.800'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93839'
references:
  - url: 'https://github.com/ModelTC/LightLLM'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/ModelTC/LightLLM/issues/1576'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_http.py#L198-L205
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_http_pd.py#L26-L36
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/httpserver_for_pd_master/manager.py#L691-L698
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/httpserver_for_pd_master/manager.py#L714-L749
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/lightllm-through-1.2.0-missing-authentication-in-pd-master-pd-register-websocket-endpoint
    label: disclosure@vulncheck.com
  - url: 'https://github.com/ModelTC/LightLLM/issues/1576'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.01009
epssPercentile: 0.61555
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-22T15:21:53.284187Z'
ingestedAt: '2026-09-18T19:49:30.602Z'
---

## Overview

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.