SGLang EUVD-2026-102845

Exploitation requires the optional debug dumper server to be explicitly enabled by setting the DUMPER_SERVER_PORT environment variable, which is what exposes the unauthenticated /dumper/configure endpoint - this is a non-default configuration and is the single most important limiting factor (reflected as AT:P in the provided CVSS 4.0 vector). Given PR:N in the CVSS vector, no authentication is required once the endpoint is reachable, and no user interaction (UI:N) is needed. The attacker must have network reachability to the configured dumper port, and code execution is not immediate - the injected payload runs on the next forward pass of the scheduler process. Deployments running default configurations without the dumper server enabled are not exposed.

This is a genuine high-priority vulnerability, but its real-world risk is strongly gated by a deployment precondition. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes unauthenticated, low-complexity, remote exploitation yielding full technical impact (VC:H/VI:H/VA:H = remote code execution in the scheduler process), which is consistent with the CWE-95 code-injection classification and the described eval() sandbox escape via re.search __globals__. Critically, the vector includes AT:P (attack requirements present), which correctly reflects that exploitation is only possible when the optional debug feature DUMPER_SERVER_PORT is configured - the /dumper/configure endpoint does not exist in a default deployment. No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public exploit code is referenced, so there is no evidence of active or at-scale exploitation; this is currently a disclosure-stage finding from VulnCheck rather than a confirmed in-the-wild threat. The practical risk therefore splits sharply: for the subset of SGLang operators who have enabled the debug dumper server, this is a critical, trivially exploitable unauthenticated RCE deserving immediate patching; for the majority running default configurations, the attack surface is simply not exposed. No key signals conflict with the description, but the absence of EPSS/KEV/POC data means the exploitation-likelihood dimension is undetermined rather than reassuringly low.

An operator runs SGLang 0.5.10-0.5.22 with the debug dumper enabled (DUMPER_SERVER_PORT set), exposing the unauthenticated /dumper/configure endpoint on the network. A remote attacker who can reach that port sends a crafted filter expression that breaks out of the eval() sandbox via re.search's __globals__, and the injected Python executes in the scheduler process on the next forward pass. No public proof-of-concept is referenced at time of analysis, though the VulnCheck advisory and linked source lines describe the technique in detail.