SGLang CVE-2026-112267

Requires that SGLang (through 0.5.22) is deployed in prefill/decode disaggregation mode AND the Decode worker's /generate endpoint is network-reachable by the attacker; exploitation uses the client-supplied bootstrap_host and bootstrap_port request fields, which are honored without authentication. No credentials, user interaction, or non-default request crafting beyond setting these fields is needed. The main limiting factor is deployment topology: single-node/non-disaggregated SGLang deployments are not affected, and environments that firewall the Decode worker off from untrusted networks substantially reduce exposure. Impact is bounded - blind outbound probing and scheduler-loop delay rather than data exfiltration or RCE.

This is a moderate-risk SSRF (CWE-918) rated 6.9 via the vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), meaning network-reachable, low-complexity, unauthenticated exploitation with no user interaction - all signals favorable to an attacker. However, the declared impact is deliberately narrow: VC:N (no confidentiality impact), VI:L and VA:L only, reflecting that the primary consequences are forcing limited outbound requests and degrading availability by blocking the shared scheduler loop, rather than data theft or code execution. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no POC is referenced, so this is no public exploit identified at time of analysis - not active exploitation. No SSVC decision data was supplied. One tension worth noting: the vendor assigned VC:N despite the description explicitly stating attackers can 'probe internal hosts and ports,' which is a form of internal network reconnaissance; a defender may reasonably treat this as low-grade information disclosure that the base vector understates. Overall this is a real but mid-tier priority - easy to trigger and useful for pivoting/recon against internal infrastructure, but without direct high-impact outcomes absent chaining.

An attacker with network access to an exposed SGLang Decode worker sends a crafted request to its /generate endpoint, supplying attacker-controlled bootstrap_host and bootstrap_port values pointing at internal infrastructure. The worker issues outbound connections to those targets, letting the attacker map internal hosts/ports (blind SSRF) and, by targeting slow or non-responsive endpoints, stall the shared scheduler loop to delay other tenants' inference requests. No authentication or user interaction is required, and no public exploit code was referenced at time of analysis.