CVE-2026-93839: LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint
LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pdregister WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket, trigger denial of service by replacing legitimate nodes, or make the PD Master issue requests to internal network addresses.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running LightLLM through 1.2.0 are affected when the PD Master exposes or can be reached at its /pd_register WebSocket endpoint. An attacker does not need authentication to exploit the endpoint.
What does an attacker need to do to exploit this issue?
The attacker needs network access to the /pd_register WebSocket endpoint and can supply crafted JSON. The endpoint does not validate the registering peer's address.
What could an attacker do after registering a malicious node?
An attacker can receive full user prompts routed to their registered socket, replace legitimate nodes to cause denial of service, or cause the PD Master to send requests to internal network addresses.
What can be done if patching is not immediately possible?
Restrict network access to the /pd_register WebSocket endpoint so untrusted clients cannot reach it. This is particularly important for PD Master instances reachable from untrusted networks.