Is CVE-2026-103041 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-103041?

CVE-2026-103041 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-103041

Description

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges.