CVE-2026-96560

CriticalCVSS 9.8/10Last modified Sep 23, 2026

Description

LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC ThreadedServer to execute arbitrary code with the privileges of the LightLLM service account.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Sep 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-965617.2The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions CVE-2026-965626.5The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14CVE-2026-965636.4The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s'CVE-2026-965647.2The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all CVE-2026-965667.2The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom FieldCVE-2026-965677.2The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to, and inclCVE-2026-965687.2The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in CVE-2026-965707.2The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' paraCVE-2026-965727.2The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in CVE-2026-965737.2The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking FormCVE-2026-965746.4The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin fCVE-2026-965757.2The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Com
CVE-2026-96560: Critical severity, CVSS 9.8 | Vulnix