An unauthenticated remote code execution vulnerability in ModelTC LightLLM allows attackers to execute arbitrary code with service account privileges via an exposed RPyC control channel.

The vulnerability exists in the KV-transfer worker when configured with the nccl mode, which creates an unauthenticated RPyC ThreadedServer. This server insecurely deserializes attacker-supplied pickled objects, allowing for arbitrary code execution without requiring any authentication.

Successful exploitation of this vulnerability grants an attacker full control over the affected LightLLM service, enabling them to execute arbitrary commands with the privileges of the service account. Given the critical CVSS score of 9.8, the business impact includes total system compromise, potential data exfiltration, and the risk of lateral movement within the production environment where the LLM infrastructure resides.

Immediate Action: Review the configuration of all LightLLM deployments to identify instances using --pd_trans_mode nccl. If the update to the latest patched version is not immediately available, restrict network access to the affected RPyC control ports to trusted internal management segments only.

Proactive Monitoring: Monitor network traffic for unusual connections to the ports used by the RPyC control channel (defaulting to the 30000-40000 range). Additionally, audit system logs for suspicious process execution spawned by the LightLLM service account.

Compensating Controls: Implement strict firewall rules to ensure that the RPyC control interface is not reachable from public networks or untrusted internal zones. Deploy network-based intrusion detection systems to identify and block serialized object payloads typical of pickle-based attacks.

Public Exploit Available: Unknown

This vulnerability presents a critical risk to infrastructure security due to the lack of authentication and the high impact of remote code execution. Administrators must verify their current LightLLM configuration and apply the vendor-provided patches as soon as they become available. Until patching is completed, strict network segmentation is required to prevent unauthorized access to the vulnerable RPyC control channel.