EUVD-2026-51263
GHSA-hg26-hr8r-fxc9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
SSRF inherently crosses system boundaries to reach internal services, warranting S:C over the provided S:U; PR:L retained as API credentials are required.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services.
AnalysisAI
Server-Side Request Forgery and local file read in SGLang's multimodal inference endpoint allows authenticated API users to exfiltrate cloud metadata, internal service responses, and secrets. The /v1/chat/completions endpoint accepts an image_url parameter that the server fetches without sanitization, enabling pivot to internal networks and cloud IMDS endpoints. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the attacker holds a valid API credential or network-level access to the SGLang `/v1/chat/completions` endpoint (CVSS PR:L); (2) the SGLang instance is configured with multimodal/vision support enabled, allowing `image_url` fields in chat messages; (3) the server process has outbound network access to internal addresses (IMDS, private subnets) or filesystem read permission for local file reads. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid SGLang API key submits a POST request to `/v1/chat/completions` with a multimodal message where `image_url` is set to `http://169.254.169.254/latest/meta-data/iam/security-credentials/`. The SGLang server fetches this URL from within the cloud environment, receives temporary AWS IAM credentials in the response body, and returns the content as part of the model's context or error output, exposing cloud credentials to the attacker. … |
| Remediation | Upgrade SGLang to a version beyond v0.5.15, which is the confirmed upper bound of affected releases per the vendor advisory at https://github.com/sgl-project/sglang/security/advisories/GHSA-x7w5-h7rp-gfp9. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker
High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without valid
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight ex
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today