LightLM PD Master /pd_register unauthenticated request hijack, plaintext prompt leak, and SSRF vulnerability

Vulnerability Overview Title: endpoint lacks authentication; an attacker can hijack requests and leak user prompts (Issue #1576) Type: Unauthenticated WebSocket accept + missing address-ownership validation + health-check SSRF Mechanism: 1. Unauthenticated WebSocket Accept: performs no authentication before calling , allowing any TCP-reachable client to send registration JSON. 2. Missing Address-Ownership Validation During Registration: In , is taken directly from the JSON provided by the attacker and is not cross-checked against the WebSocket peer address, enabling an attacker to spoof an arbitrary . 3. Request Hijacking and Prompt Leakage: The router selector forwards the complete user prompt (including , , and ) as plaintext JSON to a WebSocket controlled by the attacker. 4. Health-Check SSRF: directly interpolates the attacker-controlled into the URL with no protocol whitelist or address filtering, allowing probing of internal network services behind the PD Master. Scope of Impact Product: LightLLM Component: PD Master Affected Files: (endpoint , handler ) Registration Logic: in CWE: CWE-306 (Missing Authentication for Critical Function), CWE-918 (SSRF) Impact: - Confidentiality (High): User prompts, PIL API keys, and attribute contents are leaked in plaintext to the attacker. - Availability (High): An attacker registering a node with the same address can silently replace a legitimate node, rendering the inference service unavailable for new requests. - SSRF: The PD Master issues GET requests to attacker-specified internal targets, allowing probing/interaction with internal services. Remediation Enforce authentication before accepting registration data at the WebSocket endpoint. At minimum, validate that the in the registry matches the WebSocket peer address; authenticate via a shared secret with the Config Server. For the health-check SSRF: apply a protocol whitelist and address filtering to to prevent requests from being sent to arbitrary internal addresses. This is independent of CVE-2026-26220 (pickle deserialization RCE) and must be fixed separately. POC / Exploit Code Test Environment (POC Environment) Server: Image: Commit: Topology: Config Server + PD Master (control plane, no GPU inference nodes required) Test container: Listening on: Model: Test Procedure (POC Flow) 1. Register a fake Prefill node and intercept prompts: Send registration JSON to ( , , ), then send a normal request to ; the attacker's WebSocket receives a 28,733-byte binary frame, which when deserialized yields . 2. Same-address registration replaces a legitimate node: Legitimate node A ( ) and attacker node B ( 127.0.0.1:9999 127.0.0.1:9997 GET http://127.0.0.2:8000/health GET /health HTTP/1.1 pd_nodes_health: true`, proving that requests can be directed to any internal address.

Goal Reached Thanks to every supporter — we hit 100%!

LightLM PD Master /pd_register unauthenticated request hijack, plaintext prompt leak, and SSRF vulnerability

More from this source