sglang-router CVE-2026-112268

Exploitation requires the mesh/HA coordination mode of sglang-router (sgl-model-gateway) to be deployed and the attacker to already hold a valid data-plane API key - the key issued for ordinary inference/routing traffic, a lower trust tier than the control-plane Admin role. The specific trigger is that the /ha/* management routes (including POST /ha/shutdown) were registered without the control-plane Admin authorization layer, so any data-plane-authenticated caller reaches them. Limiting factors: the attacker must possess a legitimate data-plane credential (not unauthenticated), HA/mesh coordination must be in use (standalone/non-HA deployments expose no /ha/* routes), and affected versions are those through 0.3.2; environments where data-plane keys are tightly scoped and not shared with lower-trust components face reduced real-world risk.

This is a genuine but moderate-severity authorization flaw, not a false-alarm high-CVSS issue - and conversely not a drop-everything priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, 5.3 Medium) is internally consistent with the description: exploitation requires network reach plus an already-valid data-plane API key (PR:L), with no user interaction and low attack complexity, and the impact is limited (Low) across confidentiality, integrity, and availability rather than full system compromise. The PR:L rating is well-justified - this is a privilege-boundary bypass between two authenticated tiers (data-plane vs. control-plane/Admin), not an unauthenticated break-in. No EPSS score is provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so the realistic signal set points to no public exploit identified at time of analysis. The patch (PR #45017) and VulnCheck advisory confirm the vulnerability is real and fixed, but there is no evidence of active exploitation. Net: prioritize patching where sglang-router HA/mesh mode is deployed and data-plane keys are broadly distributed, but this is a privilege-escalation-within-trust-boundary issue, not a wormable internet-facing RCE.

An attacker (or a compromised low-trust service) possessing only a data-plane API key - intended merely for inference/routing requests - sends authenticated requests to the /ha/* mesh management endpoints, which fail to enforce the control-plane Admin role check. They read cluster topology, tamper with gossiped configuration and global rate limits, or issue POST /ha/shutdown to silently collapse HA coordination. No public exploit code is referenced, but the patched source (server.rs) and advisory make the trivial request path clear.