ModelTC LightLLM: Unauthenticated remote code execution via visual-only RPyC service
Summary
LightLLM through 1.2.0 running in visual_only mode exposes an RPyC service for the visual server without authentication, with pickle deserialization enabled. The service listens on all network interfaces by default in this mode. A remote attacker who can reach the port can send a crafted object and execute arbitrary code with the privileges of the LightLLM service account.
Affected
- LightLLM through 1.2.0 (all versions up to and including 1.2.0)
- Only deployments running in --run_mode visual_only with the visual RPyC port reachable from the network
Fixed in
Unknown.
- Upstream fix work is in pull request #1659; I could not confirm it has been merged or released.
Workaround
- Block network access to the visual RPyC port except from hosts that need it.
- Do not run LightLLM in visual_only mode if it is not required.
- Run the service under a least-privilege account without sudo or docker group membership.
- Isolate visual_only nodes in a segmented network.
Exploitation
- Unauthenticated; only network access to the port is required.
- A public proof-of-concept is described in the vendor issue, although some trackers state that no public PoC exists.
- CISA SSVC lists exploitation as poc and automatable as yes.
- No exploitation in the wild found; not listed in CISA KEV.
Our recommendation
- Inventory all LightLLM installations, including containers, and check whether they run in visual_only mode and which interfaces they bind.
- Restrict access to the visual RPyC port immediately with firewall rules.
- Reduce the service account's privileges.
- Monitor for connections to the port from unexpected hosts.
- Apply the official fix once a released version is available and watch the GitHub issue and pull request for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- LightLLM GitHub issue #1610 github.com
- LightLLM GitHub pull request #1659 github.com
- VulnCheck advisory www.vulncheck.com
- OSV CVE-2026-103395 osv.dev
- OpenCVE CVE-2026-103395 app.opencve.io
- LightLLM visual_only_manager.py v1.2.0 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:48.
Original description (NVD)
LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service account privileges.
NVD references (6)
- https://github.com/ModelTC/LightLLM
- https://github.com/ModelTC/LightLLM/issues/1610
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/visualserver/objs.py#L6-L11
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/visualserver/visual_only_manager.py#L138-L140
- https://www.vulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-remote-code-execution-via-visual-…
- https://github.com/ModelTC/LightLLM/issues/1610
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.