EUVD-2026-51265
GHSA-vwmc-327h-6x3j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Endpoint is unauthenticated and network-reachable by design; only confidentiality is affected via plaintext credential disclosure.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured.
AnalysisAI
Unauthenticated credential leakage in SGLang's /server_info HTTP endpoint exposes configured API keys and SSL keyfile paths to any network-reachable caller on all versions through v0.5.15. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and SSVC classifies the attack as automatable with a proof-of-concept available, making mass scanning for exposed instances a realistic threat. EPSS sits at just 0.14% (4th percentile), reflecting SGLang's niche deployment footprint rather than any technical difficulty - for internet-facing deployments using --admin-api-key, this is a high-priority credential-rotation and patching event.
Technical ContextAI
SGLang is an LLM inference serving runtime that exposes an HTTP API for model serving workloads. Its /server_info endpoint is designed to surface server metadata but fails to gate sensitive credential fields behind authentication when the --admin-api-key flag is active, returning those values in plaintext to unauthenticated callers. The root cause maps to CWE-522 (Insufficiently Protected Credentials), where credentials are transmitted or stored without adequate access controls - here, the HTTP response itself carries the secret material. The affected product scope per CPE cpe:2.3:a:sglang:sglang:*:*:*:*:*:*:*:* covers all SGLang releases; EUVD-2026-51265 pins the ceiling at v0.5.15. Both API key strings and SSL keyfile filesystem paths are disclosed, the latter potentially aiding further attacks against the TLS stack.
RemediationAI
Upgrade SGLang beyond v0.5.15 by consulting the vendor security advisory at https://github.com/sgl-project/sglang/security/advisories/GHSA-jx7q-p32r-7wx8 - the exact patched release version was not independently confirmed from the provided references and must be verified there before deploying. As an immediate compensating control where patching is not yet possible, block unauthenticated access to the /server_info endpoint at the reverse proxy or firewall layer (e.g., deny the path in nginx location blocks or via WAF rule); this eliminates the exposure without requiring a code change but must be validated to not break legitimate monitoring integrations. Regardless of patch timing, treat any API key previously configured via --admin-api-key as compromised and rotate it immediately, and reissue SSL certificates if the keyfile path was exposed. Additional researcher context is available at https://thoughts.apoorvdayal.com/posts/sglang-disclosures/.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in t
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 a
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code b
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the infe
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the op
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, wh
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in th
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is l
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsy
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today