EUVD-2026-30765
GHSA-gwv6-pq6m-p3rq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Default 0.0.0.0 bind exposes an unauthenticated pickle sink over the network with no user interaction, and arbitrary code execution yields full C/I/A loss, so AV:N/AC:L/PR:N and C/I/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages, enabling RCE when exposed to the internet.
AnalysisAI
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, where the generation runtime scheduler's ZeroMQ ROUTER socket binds to 0.0.0.0 by default and deserializes incoming messages with pickle.loads(). Any attacker who can reach the exposed scheduler port can send a crafted pickle payload to execute arbitrary code on the host with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, though a vendor-independent technical writeup ('three RCEs in sglang') describes the flaw; EPSS is low (0.05%) and SSVC records no observed exploitation, but the issue is rated automatable with total technical impact.
Technical ContextAI
SGLang is a high-performance serving runtime for large language and multimodal models that uses a multi-process scheduler architecture, with inter-process/inter-node coordination commonly implemented over ZeroMQ sockets. The vulnerable component is the scheduler's ROUTER socket, which is bound to the wildcard address 0.0.0.0 (all interfaces) rather than loopback, and a message-handling sink that passes attacker-controllable bytes directly into Python's pickle.loads(). This maps to CWE-502 (Deserialization of Untrusted Data): pickle is not a safe format for untrusted input because unpickling can invoke arbitrary object constructors and __reduce__ methods, turning any received message into code execution. The affected product is identified by CPE cpe:2.3:a:sglang:sglang and reported affected version sglang 5.10 (EUVD-2026-30765).
RemediationAI
No vendor-released patch version is identified at time of analysis, so prioritize network-level compensating controls: bind the scheduler ROUTER socket to loopback (127.0.0.1) or a trusted private interface instead of 0.0.0.0, and firewall/block external access to the SGLang scheduler ZeroMQ port so it is reachable only from the model-serving cluster's private subnet - the trade-off is that legitimate multi-node deployments must explicitly allowlist peer nodes rather than relying on open binding. Place SGLang behind an authenticated reverse proxy or service mesh and never expose the runtime directly to the internet; monitor the sgl-project GitHub repository (https://github.com/sgl-project/sglang) and the disclosure at https://antiproof.ai/blog/three-rces-in-sglang/ for an official fixed release, then upgrade to it once published and re-verify the socket bind address. Because the root cause is unsafe pickle deserialization (CWE-502), no configuration fully removes risk if the port remains reachable, making network isolation the essential control until a patched version is available.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
We need answer JSON only. Need synthesize. Need obey all rules. Let's parse input. CVE-2026-86793 description: SGLang a
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker
High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without valid
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight ex
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today