EUVD-2026-51265
GHSA-vwmc-327h-6x3j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Endpoint is unauthenticated and network-reachable by design; only confidentiality is affected via plaintext credential disclosure.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured.
AnalysisAI
Unauthenticated credential leakage in SGLang's /server_info HTTP endpoint exposes configured API keys and SSL keyfile paths to any network-reachable caller on all versions through v0.5.15. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and SSVC classifies the attack as automatable with a proof-of-concept available, making mass scanning for exposed instances a realistic threat. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The API key leakage occurs specifically when the SGLang server is launched with the --admin-api-key configuration flag - without this flag, no API key is present in the response to leak. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately characterizes the technical severity: the flaw is trivially reachable from the network, requires no credentials, and yields high-confidentiality-impact credential material in one HTTP round-trip. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans the internet for open SGLang inference servers using HTTP fingerprinting, then sends a single unauthenticated GET request to /server_info on a discovered instance configured with --admin-api-key; the JSON response returns the API key and SSL keyfile path in plaintext. With the recovered API key, the attacker authenticates to the inference API to consume GPU compute at the victim's expense, exfiltrate prompts and model outputs, or attempt credential reuse against other services. … |
| Remediation | Upgrade SGLang beyond v0.5.15 by consulting the vendor security advisory at https://github.com/sgl-project/sglang/security/advisories/GHSA-jx7q-p32r-7wx8 - the exact patched release version was not independently confirmed from the provided references and must be verified there before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all SGLang instances through network scanning and configuration audit; immediately rotate all admin API keys and SSL certificates configured in affected deployments; restrict network access to /server_info endpoint via firewall rules or reverse proxy (allow only trusted internal IPs). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker
High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without valid
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight ex
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today