What is the CVSS score of CVE-2026-3060?

CVE-2026-3060 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Sglang are affected by CVE-2026-3060?

A critical remote code execution vulnerability in SGLang allows unauthenticated attackers to execute arbitrary code on affected systems with no patch currently available.. A patch is available.

How to fix or mitigate CVE-2026-3060?

Within 24 hours: Inventory all systems running SGLang and isolate affected instances from production networks if possible; notify security teams and relevant stakeholders. Within 7 days: Implement network segmentation to restrict access to SGLang disaggregation modules; deploy WAF rules to block suspicious deserialization requests; disable the disaggregation feature if operationally feasible. Within 30 days: Monitor vendor communications for patch availability; evaluate alternative solutions or architecture changes to eliminate dependency on vulnerable SGLang versions; conduct forensic analysis for signs of exploitation.

Sglang CVE-2026-3060

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-12 cret@cert.org

GHSA-jx93-g359-86wm

RCE Deserialization Sglang

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 08, 2026 - 02:30 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 12:15 nvd

CRITICAL 9.8

DescriptionCVE.org

SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.

AnalysisAI

SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in the disaggregation module's inter-process communication. Same class of vulnerability as CVE-2026-3059 in a different code path.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send malicious serialized pickle object

Exploit

Disaggregation module deserializes untrusted data

Execution

Execute arbitrary Python code

Impact

Gain remote code execution

Access

Send malicious serialized pickle object

Exploit

Disaggregation module deserializes untrusted data

Execution

Execute arbitrary Python code

Impact

Gain remote code execution

Vulnerability AssessmentAI

Exploitation	No special conditions — remote unauthenticated exploitation against SGLang disaggregation module with default pickle deserialization enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 9.8 (Critical). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a crafted pickle payload to the disaggregation module's network socket. The payload executes arbitrary code on the worker node, potentially compromising the entire distributed inference cluster.
Remediation	Same as CVE-2026-3059: restrict network access, replace pickle with safe serialization, add authentication. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all systems running SGLang and isolate affected instances from production networks if possible; notify security teams and relevant stakeholders. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-3060 vulnerability details – vuln.today

Back

Sglang CVE-2026-3060

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Share

External POC / Exploit Code