LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-93839 · Microsoft / collected KEV context

cve-program · CVE-2026-93839

• https://github.com/ModelTC/LightLLM/issues/1576
• https://github.com/ModelTC/LightLLM
• https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_http_pd.py#L26-L36
• https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/httpserver_for_pd_master/manager.py#L714-L749
• https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/httpserver_for_pd_master/manager.py#L691-L698
• https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/api_http.py#L198-L205
• https://www.vulncheck.com/advisories/lightllm-through-1.2.0-missing-authentication-in-pd-master-pd-register-websocket-endpoint

No related operational record is retained in the current change model.