Summary
LightLLM through version 1.2.0 exposes reinforcement learning control routes through its public HTTP API without authentication checks. An unauthenticated attacker may disrupt inference, interrupt generation, flush caches, or cause workers to become unavailable when the deployment uses the --enable_rl option.
Affected context
The vulnerability occurs in LightLLM deployments that enable reinforcement learning controls and expose the associated HTTP API to untrusted networks. Risk depends on whether routes such as /pause_generation, /abort_request,
