CVE-2026-93839 LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-93839?
CVE-2026-93839 is a critical vulnerability in ModelTC LightLLM, published on 18 Sep 2026.
Official description
LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.
Weakness: CWE-306
Which versions are affected by CVE-2026-93839?
How do I fix CVE-2026-93839?
No fix has been published for CVE-2026-93839 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-93839 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93839 exists.
Sources
Also known as GHSA-644q-7756-5g89.