CVE-2026-93839: Critical LightLLM /pd_register Authentication Bypass — Detection and Remediation Guide

---
title: LightLLM PD Register Endpoint Access From Unauthorized Source
description: Detects inbound requests to the LightLLM /pd_register WebSocket endpoint, which is vulnerable to unauthenticated node registration in CVE-2026-93839. Tune the filter to your known inference node IP inventory.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93839
author: Security Arsenal
date: 2026/04/10
status: experimental
logsource:
  category: webserver
  product: linux
detection:
  selection:
    cs-uri-stem|contains: '/pd_register'
  filter_authorized_nodes:
    c-ip|startswith:
      - '10.10.20.'   # Replace with your authorized inference node subnets
      - '192.168.50.' # Replace with your authorized inference node subnets
  condition: selection and not filter_authorized_nodes
falsepositives:
  - Legitimate node registration from hosts not yet added to the inventory filter
level: high
---
title: LightLLM Server SSRF to Internal Address Ranges
description: Detects the LightLLM server process initiating network connections to RFC1918 or link-local addresses, consistent with CVE-2026-93839 abuse forcing the PD Master to issue requests to internal network addresses (including cloud metadata services).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93839
  - https://attack.mitre.org/techniques/T1090/
author: Security Arsenal
date: 2026/04/10
status: experimental
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
      - 'lightllm'
      - 'python'
    DestinationIp|startswith:
      - '169.254.'
      - '10.'
      - '192.168.'
      - '172.16.'
  filter_known_model_hosts:
    DestinationIp|startswith:
      - '10.10.20.'   # Replace with legitimate model/storage/peer subnets
  condition: selection and not filter_known_model_hosts
tags:
  - attack.exfiltration
  - attack.t1090
falsepositives:
  - Legitimate model weight downloads or intra-cluster traffic from hosts running lightllm under python
level: high
---
title: Suspicious Child Process Spawned by LightLLM Server
description: Detects shell or scripting interpreters spawned as children of a LightLLM serving process, indicating potential post-exploitation activity following node hijacking via CVE-2026-93839.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93839
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/10
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains: 'lightllm'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
  condition: selection_parent and selection_child
tags:
  - attack.execution
  - attack.t1059
falsepositives:
  - Wrapper scripts or health checks intentionally launched by the serving process
level: critical

// Hunt 1: Inbound requests to the vulnerable /pd_register endpoint
let AuthorizedNodes = dynamic(["10.10.20.", "192.168.50."]); // Replace with your inference node subnets
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL has "/pd_register" or AdditionalExtensions has "/pd_register"
| where not(SourceIP has_any (AuthorizedNodes))
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, RequestMethod, DeviceAction
| sort by TimeGenerated desc;

// Hunt 2: LightLLM hosts initiating connections to internal/metadata addresses (SSRF)
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has "lightllm"
| where SyslogMessage has_any ("169.254.169.254", "100.100.2.148", "metadata")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc;

// Hunt 3: New or unexpected WebSocket upgrade activity against inference servers
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where AdditionalExtensions has "Upgrade: websocket" or RequestURL has "/pd_"
| summarize ConnectionCount = count(), UniqueSources = dcount(SourceIP) by DestinationIP, DestinationPort
| where UniqueSources > 5  // Registration endpoints should see very few, stable source IPs
| sort by UniqueSources desc

-- Hunt LightLLM processes and their network connections for SSRF indicators (CVE-2026-93839)
LET lightllm_procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'lightllm'
   OR Exe =~ 'lightllm'

LET suspicious_conns = SELECT Pid, Name, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ 'python|lightllm'
  AND Raddr.IP =~ '^(169\\.254\\.|10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.)'
  AND Status =~ 'ESTABLISHED|SYN'

SELECT * FROM lightllm_procs
UNION ALL
SELECT Pid, Name, Status AS CommandLine, format(format='%v:%v', args=[RemoteIP, RemotePort]) AS Exe,
       LocalIP AS Username, NULL AS CreateTime
FROM suspicious_conns

#!/bin/bash
# CVE-2026-93839 — LightLLM verification and interim hardening
# Run as root or with sudo on each LightLLM host.

echo "=== [1] Identify installed LightLLM version ==="
if command -v pip3 >/dev/null 2>&1; then
    VER=$(pip3 show lightllm 2>/dev/null | awk '/^Version:/{print $2}')
    echo "Installed lightllm version: ${VER:-NOT FOUND}"
else
    VER=$(python3 -c 'import lightllm; print(lightllm.__version__)' 2>/dev/null)
    echo "Installed lightllm version (module): ${VER:-NOT FOUND}"
fi

if [ -n "$VER" ]; then
    # Vulnerable: all versions through 1.2.0
    if [ "$(printf '%s\n' "1.2.0" "$VER" | sort -V | head -n1)" = "$VER" ] && [ "$VER" != "1.2.1" ]; then
        if printf '%s\n%s\n' "$VER" "1.2.0" | sort -V -C; then
            echo "[!] VULNERABLE: lightllm $VER <= 1.2.0 is affected by CVE-2026-93839"
        fi
    fi
fi

echo ""
echo "=== [2] Check for exposed /pd_register listeners ==="
ss -tlnp 2>/dev/null | grep -iE 'lightllm|python' || echo "No lightllm listeners found via ss"

echo ""
echo "=== [3] Check recent access to /pd_register (common log locations) ==="
for LOG in /var/log/nginx/access.log /var/log/apache2/access.log /var/log/haproxy.log; do
    if [ -f "$LOG" ]; then
        echo "--- $LOG ---"
        grep -i 'pd_register' "$LOG" | tail -n 20
    fi
done

echo ""
echo "=== [4] Apply interim egress block to cloud metadata (SSRF mitigation) ==="
# Blocks the PD Master from reaching instance metadata services if abused for SSRF.
iptables -C OUTPUT -d 169.254.169.254 -j REJECT 2>/dev/null || \
    iptables -A OUTPUT -d 169.254.169.254 -j REJECT -m comment --comment "CVE-2026-93839 SSRF mitigation"
echo "Egress block for 169.254.169.254 applied (verify with: iptables -L OUTPUT -n)"

echo ""
echo "=== [5] Remediation: upgrade LightLLM ==="
echo "Run after change-window approval:"
echo "  pip3 install --upgrade lightllm"
echo "  # Verify the patched release notes explicitly reference CVE-2026-93839 / /pd_register auth"
echo ""
echo "=== [6] Compensating control: restrict PD Master ingress ==="
echo "Place the PD Master behind a reverse proxy or firewall that allows /pd_register"
echo "ONLY from your known inference node inventory. Example nftables rule:"
echo "  nft add rule inet filter input ip saddr != { 10.10.20.0/24, 192.168.50.0/24 } tcp dport <PD_PORT> drop"