{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/281278#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\n\r\nSix vulnerabilities have been discovered within the SGLang project, including remote code execution (RCE), server-side request forgery (SSRF), local file read, credential leakage, and model weight exfiltration on a target server. Exploitation does not require authentication in most cases, and some vulnerabilities require only network access with no API keys or user credentials. At the time of publication, no patches are available from the project maintainers, and coordination attempts have been unsuccessful.\r\n\r\n### Description\r\n\r\nSGLang is an open-source framework for serving large language models (LLMs) and multimodal AI models, supporting models such as Qwen, DeepSeek, Mistral, and Skywork, and is compatible with OpenAI APIs. Six vulnerabilities have been discovered within the tool and are tracked as follows:\r\n\r\n**CVE-2026-15969**\r\nSGLang contains unauthenticated RCE in `/load_lora_adapter_from_tensors` by bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.\r\n\r\n**CVE-2026-15971**\r\nSGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, which allows for a sandbox escape when `DUMPER_SERVER_PORT` is set, enabling code execution on inference requests.\r\n\r\n**CVE-2026-15974**\r\nSGLang contains an SSRF and local file read in the multimodal generation endpoint `/v1/chat/completions` because `image_url` input is  unsanitized, allowing access to internal metadata, secrets, and services.\r\n\r\n**CVE-2026-15976**\r\nSGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the `/update_weights_from_disk`, where `torch.load(..., weights_only=False)` fallback enables pickle deserialization of `.bin` files.\r\n\r\n**CVE-2026-15977**\r\nSGLang contains a credential leakage vulnerability in the `/server_info` endpoint, which returns API keys and SSL keyfile information when only the `--admin-api-key` is configured.\r\n\r\n**CVE-2026-15978**\r\nSGLang contains a model weight exfiltration vulnerability when no API keys are configured, because SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.\r\n\r\n### Impact\r\n\r\nIf exploited, these vulnerabilities could allow an unauthenticated attacker to achieve remote code execution, exfiltrate model weights, or overwrite arbitrary files on the host machine running SGLang. Deployments that expose the affected interface to untrusted networks are at the highest risk of exploitation.\r\n\r\n### Solution\r\n\r\nUntil a patch is available, affected users should consider the following mitigations:\r\n\r\n#### Mitigations\r\n\r\n* Restrict access to the service interfaces and ensure they are not exposed to untrusted networks.\r\n* Implement network segmentation and access controls to prevent unauthorized interaction with the vulnerable endpoints.\r\n* Change `SGLANG_USE_PICKLE_IPC` to \"false\" within `environ.py`.\r\n* Disable endpoints not in use to remove potential attack vectors. \r\n\r\nThe SGLang maintainers have begun addressing pickle deserialization vulnerabilities and are working to refactor the code base with `msgpack` to prevent deserialization issues such as CVE-2026-14890, but the `SGLANG_USE_PICKLE_IPC` defaults to `true` within the codebase at the time of writing.\r\n\r\n### Acknowledgements\r\nThanks to the reporter, Apoorv Dayal [apoorvdayal@outlook.com]. This document was written by Christopher Cullen.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/281278"},{"url":"https://github.com/sgl-project/sglang/security/advisories/GHSA-2wvm-gjg7-5jfm","summary":"https://github.com/sgl-project/sglang/security/advisories/GHSA-2wvm-gjg7-5jfm"},{"url":"https://github.com/sgl-project/sglang/security/advisories/GHSA-h6rf-77vv-9mvj","summary":"https://github.com/sgl-project/sglang/security/advisories/GHSA-h6rf-77vv-9mvj"},{"url":"https://github.com/sgl-project/sglang/security/advisories/GHSA-wf98-gv64-5wrf","summary":"https://github.com/sgl-project/sglang/security/advisories/GHSA-wf98-gv64-5wrf"},{"url":"https://github.com/sgl-project/sglang/security/advisories/GHSA-x7w5-h7rp-gfp9","summary":"https://github.com/sgl-project/sglang/security/advisories/GHSA-x7w5-h7rp-gfp9"},{"url":"https://github.com/sgl-project/sglang/security/advisories/GHSA-jx7q-p32r-7wx8","summary":"https://github.com/sgl-project/sglang/security/advisories/GHSA-jx7q-p32r-7wx8"},{"url":"https://github.com/sgl-project/sglang/security/advisories/GHSA-cpqq-22v3-2wfm","summary":"https://github.com/sgl-project/sglang/security/advisories/GHSA-cpqq-22v3-2wfm"},{"url":"https://thoughts.apoorvdayal.com/posts/sglang-disclosures/","summary":"https://thoughts.apoorvdayal.com/posts/sglang-disclosures/"}],"title":"SGLang contains six different vulnerabilities including RCE, data exfiltration, and credential disclosure","tracking":{"current_release_date":"2026-07-30T18:09:40+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.43"}},"id":"VU#281278","initial_release_date":"2026-07-30 18:09:29.046268+00:00","revision_history":[{"date":"2026-07-30T18:09:40+00:00","number":"1.20260730180940.2","summary":"Released on 2026-07-30T18:09:40+00:00"}],"status":"final","version":"1.20260730180940.2"}},"vulnerabilities":[{"title":"SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.","notes":[{"category":"summary","text":"SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads."}],"cve":"CVE-2026-15969","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#281278"}]},{"title":"SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests.","notes":[{"category":"summary","text":"SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests."}],"cve":"CVE-2026-15971","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#281278"}]},{"title":"SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services.","notes":[{"category":"summary","text":"SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services."}],"cve":"CVE-2026-15974","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#281278"}]},{"title":"SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.","notes":[{"category":"summary","text":"SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files."}],"cve":"CVE-2026-15976","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#281278"}]},{"title":"SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured.","notes":[{"category":"summary","text":"SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured."}],"cve":"CVE-2026-15977","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#281278"}]},{"title":"SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.","notes":[{"category":"summary","text":"SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights."}],"cve":"CVE-2026-15978","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#281278"}]}],"product_tree":{"branches":[]}}