SGLang CVE-2026-111392

Applies to SGLang servers serving multimodal models with the prefix-cache (KV cache) active, where caller-supplied mm_hashes are honored - the default behavior in versions through 0.5.21 before the fix introduced the opt-in --trust-caller-mm-hashes flag. The attacker must send requests to the /generate endpoint and must know or predict the content hash used for a victim's image to alias its cached KV entry; this hash-prediction requirement (reflected as AC:H/AT:P) is the primary limiting factor. Exploitation is further limited to shared/multi-tenant deployments where one server processes multiple parties' requests; single-tenant or non-multimodal deployments are not meaningfully exposed. No user interaction or authentication is required.

This is a genuine but moderate-priority multi-tenant data-integrity/disclosure flaw, not a hair-on-fire issue. The input CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N, score 6.3 Medium) is internally consistent with the description: exploitation is network-reachable via /generate and unauthenticated (PR:N), but carries High complexity (AC:H) and a Present attack requirement (AT:P) because the attacker must know or predict another request's mm_hash to alias its cached KV - a non-trivial prerequisite that materially lowers real-world risk. Impact is correctly bounded as Low confidentiality and Low integrity (cross-request image disclosure or response corruption), with no availability impact. No EPSS score was provided; the CVE is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The signals do not conflict: a mid-range CVSS, absence of KEV/POC, and a VulnCheck research origin together point to a credible, vendor-confirmed weakness that is realistically exploitable only against multimodal SGLang deployments where an attacker can guess or learn the victim's content hash. Note the source-code evidence clarifies the mechanism: in vulnerable versions caller-supplied mm_hashes were trusted, and the fix gates this behind an opt-in --trust-caller-mm-hashes flag (default off).

An attacker sends requests to a shared multimodal SGLang inference server's /generate endpoint, supplying mm_hashes that match the content hash of another tenant's image. Because SGLang trusts the caller-declared hash as the prefix-cache key, the attacker's request either reuses (and thereby observes effects of) the victim's cached KV entries or corrupts what the victim receives. No public exploit code is referenced, and success requires the attacker to know or predict the target hash (AC:H/AT:P).