Software Engineering Institute

Overview

Six vulnerabilities have been discovered within the SGLang project, including remote code execution (RCE), server-side request forgery (SSRF), local file read, credential leakage, and model weight exfiltration on a target server. Exploitation does not require authentication in most cases, and some vulnerabilities require only network access with no API keys or user credentials. At the time of publication, no patches are available from the project maintainers, and coordination attempts have been unsuccessful.

Description

SGLang is an open-source framework for serving large language models (LLMs) and multimodal AI models, supporting models such as Qwen, DeepSeek, Mistral, and Skywork, and is compatible with OpenAI APIs. Six vulnerabilities have been discovered within the tool and are tracked as follows:

CVE-2026-15969
SGLang contains unauthenticated RCE in /load_lora_adapter_from_tensors by bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.

CVE-2026-15971
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, which allows for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests.

CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions because image_url input is unsanitized, allowing access to internal metadata, secrets, and services.

CVE-2026-15976
SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files.

CVE-2026-15977
SGLang contains a credential leakage vulnerability in the /server_info endpoint, which returns API keys and SSL keyfile information when only the --admin-api-key is configured.

CVE-2026-15978
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, because SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.

Impact

If exploited, these vulnerabilities could allow an unauthenticated attacker to achieve remote code execution, exfiltrate model weights, or overwrite arbitrary files on the host machine running SGLang. Deployments that expose the affected interface to untrusted networks are at the highest risk of exploitation.

Solution

Until a patch is available, affected users should consider the following mitigations:

Mitigations

• Restrict access to the service interfaces and ensure they are not exposed to untrusted networks.
• Implement network segmentation and access controls to prevent unauthorized interaction with the vulnerable endpoints.
• Change SGLANG_USE_PICKLE_IPC to "false" within environ.py.
• Disable endpoints not in use to remove potential attack vectors.

The SGLang maintainers have begun addressing pickle deserialization vulnerabilities and are working to refactor the code base with msgpack to prevent deserialization issues such as CVE-2026-14890, but the SGLANG_USE_PICKLE_IPC defaults to true within the codebase at the time of writing.

Acknowledgements

Thanks to the reporter, Apoorv Dayal [apoorvdayal@outlook.com]. This document was written by Christopher Cullen.

Vendor Information

References

• https://github.com/sgl-project/sglang/security/advisories/GHSA-2wvm-gjg7-5jfm
• https://github.com/sgl-project/sglang/security/advisories/GHSA-h6rf-77vv-9mvj
• https://github.com/sgl-project/sglang/security/advisories/GHSA-wf98-gv64-5wrf
• https://github.com/sgl-project/sglang/security/advisories/GHSA-x7w5-h7rp-gfp9
• https://github.com/sgl-project/sglang/security/advisories/GHSA-jx7q-p32r-7wx8
• https://github.com/sgl-project/sglang/security/advisories/GHSA-cpqq-22v3-2wfm
• https://thoughts.apoorvdayal.com/posts/sglang-disclosures/