Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-96560
By Nevo Evenhaim |
23 September 2026
CVE-2026-96560 – LightLLM unauthenticated RCE via RPyC pickle deserialization in NCCL PD mode
Unauthenticated RCE in LightLLM KV-transfer worker when started with –pd_trans_mode nccl. The exposed RPyC ThreadedServer control channel deserializes attacker-supplied pickled objects, x§allowing arbitrary code execution as the LightLLM service account. Affected: `LightLLM