CVE-2026-103270

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-103270

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103270.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-103270

Published

2026-09-30T14:48:55Z

Modified

2026-10-02T03:47:25Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

LightLLM through 1.2.0 Missing Authentication on RL Control Routes

Details

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference operations and wedge workers on deployments started with --enable_rl.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103270.json"
}

References

Affected packages

Git / github.com/modeltc/lightllm

Affected ranges

Type

GIT

Repo

https://github.com/modeltc/lightllm

Events

Introduced

Fixed

65c174ee95ac6a6fd36b18b63d0b33d97e76b770

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.2.0"
        },
        {
            "fixed":  "1.2.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v1.*

v1.0.0

v1.0.1

v1.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103270.json"