Unauthenticated RCE Vulnerability in LightLLM Config Server

• •LightLLM Config Server up to version 1.2.0 is vulnerable to unauthenticated RCE.
• •The vulnerability arises from unsafe deserialization of client-supplied data.
• •CVE-2026-26220 was published on February 17, 2026, detailing this issue.

LightLLM Config Server versions up to 1.2.0 are vulnerable to an unauthenticated remote code execution (RCE) flaw due to unsafe deserialization in the /visual_register WebSocket endpoint. The vulnerability, identified as CWE-502, allows attackers to exploit the endpoint by sending crafted pickle payloads without any authentication checks. This can lead to arbitrary code execution with the privileges of the Config Server process. The vulnerability was confirmed through testing, demonstrating that both unauthenticated and invalid-credential cases resulted in code execution. The affected code directly deserializes input from clients, exposing the service to potential exploitation if network-reachable. The issue has been documented in GitHub Issue #1563 and is linked to CVE-2026-26220, published on February 17, 2026. Security professionals are advised to assess their deployments and apply necessary mitigations.