EUVD-2026-51263
GHSA-hg26-hr8r-fxc9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
SSRF inherently crosses system boundaries to reach internal services, warranting S:C over the provided S:U; PR:L retained as API credentials are required.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services.
AnalysisAI
Server-Side Request Forgery and local file read in SGLang's multimodal inference endpoint allows authenticated API users to exfiltrate cloud metadata, internal service responses, and secrets. The /v1/chat/completions endpoint accepts an image_url parameter that the server fetches without sanitization, enabling pivot to internal networks and cloud IMDS endpoints. Affecting all SGLang releases through v0.5.15, this is a high-confidentiality-impact flaw with no public exploit or CISA KEV listing identified at time of analysis, and an EPSS of 0.14% (4th percentile) suggesting limited opportunistic exploitation to date.
Technical ContextAI
SGLang is an open-source LLM serving and inference framework (cpe:2.3:a:sglang:sglang:*:*:*:*:*:*:*:*) that exposes an OpenAI-compatible REST API, including the /v1/chat/completions endpoint with multimodal (vision) support. When a client submits a chat completion request with a message containing an image_url field, the server fetches the URL server-side to retrieve image content for processing. The root cause is CWE-918 (Server-Side Request Forgery): the framework does not validate or restrict the URL scheme, hostname, or destination prior to making the outbound HTTP request. This allows the URL to target http://169.254.169.254/ (AWS/GCP/Azure IMDS), file:// URIs for local filesystem reads, or private RFC-1918 addresses to probe internal services - all from the perspective of the SGLang server process.
RemediationAI
Upgrade SGLang to a version beyond v0.5.15, which is the confirmed upper bound of affected releases per the vendor advisory at https://github.com/sgl-project/sglang/security/advisories/GHSA-x7w5-h7rp-gfp9. The exact patched release version is not independently confirmed in the available data - verify the specific fix version against the upstream changelog before deploying. If immediate upgrade is not feasible, restrict the network egress of the SGLang server process via firewall or security group rules to block outbound connections to link-local ranges (169.254.0.0/16), private RFC-1918 networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and localhost (127.0.0.0/8); this mitigates IMDS and internal service pivoting but does not prevent external SSRF. Additionally, disable file:// scheme handling at the OS level if possible, or run the SGLang process in a restricted network namespace. Trade-off: network egress restrictions may break legitimate multimodal requests that reference externally hosted images - consider allowlisting approved image CDN domains instead of broad blocking.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in th
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is l
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today