Loading story…
Multiple vulnerabilities in LightLLM through version 1.2.0 expose reachable AI inference deployments to unauthenticated remote code execution (RCE) and operational disruption. Critical flaws tracked as CVE-2026-103040, CVE-2026-103041, and CVE-2026-103395 involve unsafe pickle-backed deserialization in exposed RPyC services, including profiling and visual_only image-inference deployments. An attacker able to reach an affected RPyC port can submit crafted Python objects—such as one abusing __reduce__—and execute code with the privileges of the LightLLM service account. The profiling path requires --enable_profiling; the visual deployment issue affects the remote_infer_images method.
Additional weaknesses permit unauthenticated denial-of-service and inference disruption. CVE-2026-103042 can exhaust memory through the NCCL control channel, while CVE-2026-103270 exposes reinforcement-learning control endpoints when LightLLM runs with --enable_rl, allowing remote callers to pause generation, abort requests, flush caches, initialize weight-update groups, and potentially wedge workers. No public exploitation, known victims, or CISA KEV listing had been reported. Organizations should disable profiling, RPyC, and RL features where unnecessary; restrict all related service and dynamically assigned profiler ports to trusted networks; apply vendor fixes when available; review potentially exposed instances; and rotate credentials accessible to inference processes.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-103395 was published for LightLLM through 1.2.0 in visual_only deployments. The unauthenticated visual RPyC service accepts pickle-deserialized attacker-controlled arguments to remote_infer_images, allowing arbitrary code execution as the LightLLM service account.
CVE-2026-103270 was published for LightLLM through 1.2.0, where deployments launched with --enable_rl expose reinforcement-learning control endpoints without authentication. Remote attackers could invoke endpoints including pause_generation, abort_request, flush_cache, and init_weights_update_group to disrupt inference and potentially wedge workers.
Three vulnerabilities affecting LightLLM through version 1.2.0 were disclosed: CVE-2026-103040 and CVE-2026-103041, unauthenticated RCE flaws involving pickle deserialization in RPyC services, and CVE-2026-103042, an unauthenticated NCCL control-channel memory-exhaustion flaw. At disclosure, no confirmed patch or public exploitation had been reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
linuxsecurity.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcethreataft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers began exploiting **CVE-2026-33626** in LMDeploy less than 13 hours after public disclosure, using a server-side request forgery flaw in vision-language request handling to make inference servers fetch attacker-controlled and internal URLs. Sysdig said the bug affects LMDeploy `0.12.0` and earlier with vision-language support, where `image_url` input is not properly restricted, and observed an eight-minute attack against its honeypot that probed AWS instance metadata, localhost services, an unauthenticated administrative endpoint, and an out-of-band callback domain. The activity included scans of loopback ports associated with **Redis**, **MySQL**, and HTTP services, underscoring the risk of exposing AI inference infrastructure to internal network discovery and cloud credential theft. The disclosures also highlighted broader weaknesses in LLM-serving platforms. LiteLLM published three advisories for LiteLLM Proxy that researchers said can be chained to achieve **remote code execution**, including an unauthenticated SQL injection (`GHSA-r75f-5x8p-qvmc`), a server-side template injection flaw, and an authenticated command-execution issue in MCP stdio test endpoints. The affected LiteLLM range is `1.81.16` through `1.83.6`, with fixes available in `1.83.7-stable` and later, while LMDeploy users were urged to upgrade to `v0.12.3+`, enforce **IMDSv2**, restrict egress, rotate IAM credentials, and monitor inference hosts for requests to metadata, loopback, and private-network addresses.
Jun 29, 2026
CISA added **CVE-2026-42271** to its Known Exploited Vulnerabilities catalog after evidence emerged that attackers are exploiting a command injection flaw in BerriAI **LiteLLM**. The bug affects MCP server test endpoints in self-hosted LiteLLM deployments, where crafted `stdio` parameters can trigger arbitrary command execution on the proxy host. On its own, the flaw requires a valid proxy API key, but researchers reported it is being chained with **CVE-2026-48710** in **Starlette**—a Host header validation bypass known as **BadHost**—to bypass authentication and achieve unauthenticated remote code execution. The exposed attack path affects LiteLLM versions **1.74.2 through 1.83.6** when deployed with **Starlette 1.0.0 or earlier**, and researchers rated the combined chain as effectively **critical** with a CVSS score of **10.0**. Successful compromise can let attackers run OS commands, steal model provider credentials, API keys, secrets, and environment variables, and pivot into connected AI infrastructure. BerriAI patched the issue in **LiteLLM 1.83.7** by restricting the vulnerable test endpoints to the `PROXY_ADMIN` role, while defenders are being urged to upgrade LiteLLM and Starlette, limit network access to the affected endpoints, rotate stored credentials, and review logs for suspicious Host header and subprocess activity.
Jun 29, 2026
**CVE-2026-22778** is a critical vulnerability in *vLLM* (an LLM inference/serving engine) that can enable **remote code execution (RCE)** when a server processes attacker-supplied multimodal content (e.g., a crafted video/image payload). The issue stems from vLLM returning a **PIL error** to the client when an invalid image is submitted to a multimodal endpoint, which **leaks a heap address** and dramatically weakens ASLR (reported as reducing brute-force from billions of guesses to ~8). This information disclosure can then be chained with a **heap overflow** in the **JPEG2000 decoder** within bundled **OpenCV/FFmpeg** components to hijack execution flow and run arbitrary commands on the host. Operational risk is elevated because many **default vLLM deployments** (including common `pip`/Docker installs) may be exposed without authentication, and reporting indicates exploitation may still be possible **pre-auth** even when API keys are enabled (via an “invocations” route). The vulnerability affects versions **0.8.3 through < 0.14.1** and is **fixed in vLLM 0.14.1**; remediation should prioritize upgrading to `>= 0.14.1` and reviewing exposure of multimodal endpoints, especially any internet-accessible instances.
Jul 12, 2026