Sglang
Monthly
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in the ZMQ message decoder, which processes PickleWrapper payloads via pickle.loads() without type allowlisting or authentication. While default single-node deployments bind the ZMQ control channel to loopback, remote exploitation becomes possible when data-parallel attention is enabled and --dist-init-addr is set to a non-loopback address. Disabling SGLANG_USE_PICKLE_IPC does not eliminate the risk because the msgpack code path still reaches pickle.loads(), and no public exploit code has been identified at time of analysis.
Denial of service in SGLang 0.5.20 and earlier: the /generate HTTP endpoint in prefill/decode (PD) disaggregation deployments using the Mooncake KV transfer backend does not validate duplicate bootstrap_room identifiers, so remote unauthenticated attackers who fire concurrent requests carrying the same bootstrap_room value can crash scheduler processes or stall other users' requests until the transfer times out. The attack is trivial and requires no authentication or user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, availability-only VA:H), but it only affects the non-default multi-node PD disaggregation configuration with the Mooncake backend; single-node and default deployments are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the impact is purely availability-related with no confidentiality or integrity loss.
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is launched in disaggregated-diffusion mode, where the DiffusionServer orchestrator binds a ZeroMQ ROUTER socket to a network-reachable interface with no authentication and passes the final frame of every received multipart message directly into pickle.loads() before any validation is performed. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw lets any remote party that can deliver a multipart ZMQ message to that socket execute arbitrary Python code in the serving process, yielding full compromise of confidentiality, integrity and availability on the host. No public exploit identified at time of analysis; exploitation requires the exposed orchestrator socket to be reachable beyond localhost, so loopback-bound or single-node deployments are not remotely exploitable.
Memory-exhaustion denial of service in SGLang through 0.5.20 allows anyone who can reach the decode engine's internal ZMQ rank port to terminate the serving process by sending a single STAGING_REQ frame carrying an extremely large chunk_idx value. The flaw applies only to deployments running prefill/decode disaggregation - a non-default, multi-engine serving topology - and requires network reachability to the inter-rank ZMQ port that normally carries unauthenticated traffic on a trusted cluster network; when that port is bound to loopback or an isolated back-end network, the issue is not reachably exploitable. No public exploit identified at time of analysis, and the impact is confined to availability: the scheduler allocates memory until the system runs out and the process is killed, with no data exposure or code execution.
Unauthenticated memory exhaustion in SGLang through 0.5.19 lets remote attackers force out-of-memory termination of the prefill process by submitting arbitrary bootstrap_room values to the decode engine's POST /generate endpoint. The flaw only manifests in a non-default deployment: prefill/decode disaggregation mode with the Mooncake KV transfer backend enabled, which is not the standard monolithic serving configuration, and the endpoint must be network-reachable. No public exploit code was identified at time of analysis, and the vulnerability is not confirmed actively exploited (CISA KEV); impact is confined to availability (CVSS 4.0 base 8.7; independent assessment scores the same issue 7.5 under CVSS 3.1), with no data exposure or code execution.
Unauthenticated routing-table poisoning in SGLang through 0.5.19 lets any attacker who can reach the prefill bootstrap service in a prefill/decode (PD) disaggregation deployment issue a PUT /route request and rewrite the KV transfer routing table. By supplying arbitrary rank_ip and rank_port values, the attacker redirects decode workers to attacker-controlled endpoints, which yields a denial of service against the serving cluster and discloses KV transfer metadata such as session identifiers and tensor-parallel topology parameters. The flaw is remotely reachable, unauthenticated, and requires no user interaction (CVSS 8.8; CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H), but it is conditionally gated: it only applies to the non-default, multi-node PD disaggregation topology where the prefill bootstrap service is network-reachable, so single-node or default deployments are unaffected. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the practical limiting factor is deployment configuration and exposure of the bootstrap port rather than the exploitation technique itself.
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the /update_weights_from_tensor endpoint when no authentication keys are configured. The SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr remain resolvable, enabling malicious pickle REDUCE instructions to execute attacker-supplied code. EPSS is 0.21% and no CISA KEV or public exploit is identified, but CVSS rates the flaw critical.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary commands by abusing the /load_lora_adapter_from_tensors endpoint, which deserializes attacker-supplied base64-encoded pickle payloads. The framework's SafeUnpickler relies on an incomplete denylist that can be bypassed, so a crafted pickle stream reaches dangerous reduce logic and executes OS commands on the serving host. Rated CVSS 9.8 with SSVC total technical impact and marked automatable; no public exploit has been confirmed and EPSS is a modest 0.65% (48th percentile), so widespread automated exploitation is not yet evidenced.
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight exfiltration when the server is deployed without API key authentication. Attackers can abuse distributed weight broadcasting via NCCL - the same mechanism used for legitimate inter-GPU weight distribution - to redirect all model weights to an attacker-controlled destination, resulting in total confidentiality loss of what may be highly valuable proprietary ML assets. No public exploit code or CISA KEV listing is confirmed at time of analysis; EPSS at 0.19% (9th percentile) reflects low observed exploitation activity, consistent with this being a targeted threat against specialized ML infrastructure rather than opportunistic mass exploitation.
Unauthenticated credential leakage in SGLang's /server_info HTTP endpoint exposes configured API keys and SSL keyfile paths to any network-reachable caller on all versions through v0.5.15. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and SSVC classifies the attack as automatable with a proof-of-concept available, making mass scanning for exposed instances a realistic threat. EPSS sits at just 0.14% (4th percentile), reflecting SGLang's niche deployment footprint rather than any technical difficulty - for internet-facing deployments using --admin-api-key, this is a high-priority credential-rotation and patching event.
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the inference server by abusing the /update_weights_from_disk endpoint, which falls back to torch.load(..., weights_only=False) and thus deserializes attacker-controlled pickle streams embedded in .bin model-weight files. Because SGLang's HTTP serving API is typically exposed without authentication, an attacker able to reach the endpoint and influence the loaded weights path can achieve code execution as the serving process. This is a CWE-502 deserialization flaw rated CVSS 9.8; a vendor security advisory (GHSA-wf98-gv64-5wrf) and a public technical disclosure exist, though EPSS remains low (0.26%, 18th percentile) and it is not in CISA KEV - no public exploit identified at time of analysis beyond the disclosure write-up.
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the optional dumper subsystem, escaping the intended sandbox when DUMPER_SERVER_PORT is configured. The flaw is code injection (CWE-95) triggered via inference requests, carrying a CVSS 9.8 with SSVC noting proof-of-concept exploit code and automatable exploitation. Currently there is publicly available exploit code exists per the CERT/CC disclosure, though EPSS remains low at 0.17% (7th percentile), and it is not listed in CISA KEV.
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsystem binds a ZeroMQ PULL socket to a routable interface without authentication or safe deserialization, letting a network attacker send a crafted pickle payload that executes arbitrary code in the serving process. It affects deployments where the elastic expert-parallel backup feature is enabled and the socket is reachable. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 arises when the non-default `--enable-custom-logit-processor` flag is set, allowing attacker-supplied Python objects to be deserialized via `dill.loads()` and execute arbitrary code on the inference host. No CISA KEV listing exists and SSVC records exploitation as 'none', but a public technical write-up (antiproof.ai, 'Three RCEs in SGLang') details the flaw and SSVC marks it automatable with total technical impact. EPSS is modest at 0.32% (55th percentile), consistent with a serious-but-conditional (feature-gated) issue rather than mass exploitation.
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker to place files anywhere the server process can write by embedding ../ sequences in an upload filename sent to specific endpoints. Because the affected process typically runs LLM inference workloads, a written file can be leveraged toward code execution or service disruption. A public technical write-up describing multiple SGLang RCEs exists, though the EPSS probability is very low (0.07%) and the issue is not listed in CISA KEV.
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, where the generation runtime scheduler's ZeroMQ ROUTER socket binds to 0.0.0.0 by default and deserializes incoming messages with pickle.loads(). Any attacker who can reach the exposed scheduler port can send a crafted pickle payload to execute arbitrary code on the host with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, though a vendor-independent technical writeup ('three RCEs in sglang') describes the flaw; EPSS is low (0.05%) and SSVC records no observed exploitation, but the issue is rated automatable with total technical impact.
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code by loading specially crafted model files with malicious Jinja2 templates. The vulnerability stems from unsandboxed rendering of tokenizer.chat_template fields, enabling template injection attacks. Publicly available exploit code exists (GitHub POC by Stuub). With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and SSVC ratings of automatable with total technical impact, this represents critical risk for exposed SGLang deployments handling untrusted model files.
High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in the disaggregation module's inter-process communication. Same class of vulnerability as CVE-2026-3059 in a different code path.
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker, enabling remote code execution. Any attacker who can reach the ZMQ port can execute arbitrary Python code on the ML inference server.
Unauthenticated remote credential disclosure in SGLang (sgl-project/sglang) up to version 0.5.21, where the /server_info HTTP endpoint and the gRPC GetServerInfo path returned the entire ServerArgs dataclass and thereby exposed the configured api_key, admin_api_key, and ssl_keyfile_password values verbatim to any network-reachable caller. No privileges or user interaction are required (CVSS 4.0 vector PR:N/UI:N, with E:P indicating a proof-of-concept), and publicly available exploit code exists; KEV has not flagged this as actively exploited. Impact is confidentiality-only but potentially severe - a leaked admin API key gives full control of the inference service - with the practical gate being whether the operator actually configured a secret and left the management endpoint exposed. A vendor fix exists only as an unmerged pull request (PR #30343), so released patched versions could not be confirmed at analysis time.
Malformed ZeroMQ AUX_DATA control messages can terminate the Decode worker's control thread in SGLang 0 through 0.5.15, letting an unauthenticated attacker who can reach the Decode control PULL socket take the inference server offline. The flaw is a missing input-validation check on the control-message path (availability-only impact; no data exposure or code execution), and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H for a base score of 5.9. Exploitation is realistic only where the Decode control socket is exposed beyond localhost in disaggregated or multi-node deployments, which is why the attack complexity is rated High; no public exploit has been identified at time of analysis and the issue is not in CISA KEV.
Server-Side Request Forgery and local file read in SGLang's multimodal inference endpoint allows authenticated API users to exfiltrate cloud metadata, internal service responses, and secrets. The `/v1/chat/completions` endpoint accepts an `image_url` parameter that the server fetches without sanitization, enabling pivot to internal networks and cloud IMDS endpoints. Affecting all SGLang releases through v0.5.15, this is a high-confidentiality-impact flaw with no public exploit or CISA KEV listing identified at time of analysis, and an EPSS of 0.14% (4th percentile) suggesting limited opportunistic exploitation to date.
Hash collision weaknesses in SGLang's multimodal Cache Handler (all versions through 0.5.11) allow a local low-privilege attacker to craft multimodal tensor inputs that produce identical cache keys via truncated SHA256 digests, causing incorrect cache lookups or cache invalidation failures that disrupt LLM serving workflows. The CVSS 4.0 score of 1.1 reflects the strictly local attack vector and high exploitation complexity, limiting real-world impact primarily to multi-tenant inference deployments. Publicly available exploit code exists per GitHub issue #25462, though no confirmed active exploitation has been observed and the vulnerability is not listed in the CISA KEV catalog.
Reachable assertion in SGLang 0.5.10.post1's LoRA adapter scheduler allows a remote unauthenticated attacker to trigger a denial of service via a crafted `lora_path` argument to the inference HTTP endpoint. The root cause is a logic flaw in the batch prefill scheduler: chunked LoRA prefill requests already admitted to the prefill queue are invisible to the LoRA admission check, enabling N+1 distinct adapters to be submitted when `max_loras_per_batch=N`, which forces an assertion failure in `lora_manager.py`. A publicly available proof-of-concept exists (no public exploit identified at time of analysis in the KEV sense), and the CVSS 4.0 score of 2.9 reflects high attack complexity and limited availability impact.
Unauthenticated remote code execution in SGLang versions through v0.5.20 arises from unsafe pickle deserialization in the ZMQ message decoder, which processes PickleWrapper payloads via pickle.loads() without type allowlisting or authentication. While default single-node deployments bind the ZMQ control channel to loopback, remote exploitation becomes possible when data-parallel attention is enabled and --dist-init-addr is set to a non-loopback address. Disabling SGLANG_USE_PICKLE_IPC does not eliminate the risk because the msgpack code path still reaches pickle.loads(), and no public exploit code has been identified at time of analysis.
Denial of service in SGLang 0.5.20 and earlier: the /generate HTTP endpoint in prefill/decode (PD) disaggregation deployments using the Mooncake KV transfer backend does not validate duplicate bootstrap_room identifiers, so remote unauthenticated attackers who fire concurrent requests carrying the same bootstrap_room value can crash scheduler processes or stall other users' requests until the transfer times out. The attack is trivial and requires no authentication or user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, availability-only VA:H), but it only affects the non-default multi-node PD disaggregation configuration with the Mooncake backend; single-node and default deployments are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the impact is purely availability-related with no confidentiality or integrity loss.
Unauthenticated remote code execution in SGLang 0.5.11 through 0.5.14 occurs when the multimodal generation runtime is launched in disaggregated-diffusion mode, where the DiffusionServer orchestrator binds a ZeroMQ ROUTER socket to a network-reachable interface with no authentication and passes the final frame of every received multipart message directly into pickle.loads() before any validation is performed. Rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw lets any remote party that can deliver a multipart ZMQ message to that socket execute arbitrary Python code in the serving process, yielding full compromise of confidentiality, integrity and availability on the host. No public exploit identified at time of analysis; exploitation requires the exposed orchestrator socket to be reachable beyond localhost, so loopback-bound or single-node deployments are not remotely exploitable.
Memory-exhaustion denial of service in SGLang through 0.5.20 allows anyone who can reach the decode engine's internal ZMQ rank port to terminate the serving process by sending a single STAGING_REQ frame carrying an extremely large chunk_idx value. The flaw applies only to deployments running prefill/decode disaggregation - a non-default, multi-engine serving topology - and requires network reachability to the inter-rank ZMQ port that normally carries unauthenticated traffic on a trusted cluster network; when that port is bound to loopback or an isolated back-end network, the issue is not reachably exploitable. No public exploit identified at time of analysis, and the impact is confined to availability: the scheduler allocates memory until the system runs out and the process is killed, with no data exposure or code execution.
Unauthenticated memory exhaustion in SGLang through 0.5.19 lets remote attackers force out-of-memory termination of the prefill process by submitting arbitrary bootstrap_room values to the decode engine's POST /generate endpoint. The flaw only manifests in a non-default deployment: prefill/decode disaggregation mode with the Mooncake KV transfer backend enabled, which is not the standard monolithic serving configuration, and the endpoint must be network-reachable. No public exploit code was identified at time of analysis, and the vulnerability is not confirmed actively exploited (CISA KEV); impact is confined to availability (CVSS 4.0 base 8.7; independent assessment scores the same issue 7.5 under CVSS 3.1), with no data exposure or code execution.
Unauthenticated routing-table poisoning in SGLang through 0.5.19 lets any attacker who can reach the prefill bootstrap service in a prefill/decode (PD) disaggregation deployment issue a PUT /route request and rewrite the KV transfer routing table. By supplying arbitrary rank_ip and rank_port values, the attacker redirects decode workers to attacker-controlled endpoints, which yields a denial of service against the serving cluster and discloses KV transfer metadata such as session identifiers and tensor-parallel topology parameters. The flaw is remotely reachable, unauthenticated, and requires no user interaction (CVSS 8.8; CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H), but it is conditionally gated: it only applies to the non-default, multi-node PD disaggregation topology where the prefill bootstrap service is network-reachable, so single-node or default deployments are unaffected. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the practical limiting factor is deployment configuration and exposure of the bootstrap port rather than the exploitation technique itself.
Remote code execution in SGLang AI inference servers allows unauthenticated attackers to run arbitrary code through the /update_weights_from_tensor endpoint when no authentication keys are configured. The SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr remain resolvable, enabling malicious pickle REDUCE instructions to execute attacker-supplied code. EPSS is 0.21% and no CISA KEV or public exploit is identified, but CVSS rates the flaw critical.
Remote code execution in SGLang (versions up to and including 0.5.15) allows unauthenticated attackers to run arbitrary commands by abusing the /load_lora_adapter_from_tensors endpoint, which deserializes attacker-supplied base64-encoded pickle payloads. The framework's SafeUnpickler relies on an incomplete denylist that can be bypassed, so a crafted pickle stream reaches dangerous reduce logic and executes OS commands on the serving host. Rated CVSS 9.8 with SSVC total technical impact and marked automatable; no public exploit has been confirmed and EPSS is a modest 0.65% (48th percentile), so widespread automated exploitation is not yet evidenced.
SGLang versions up to and including v0.5.15 expose unauthenticated network endpoints that allow complete model weight exfiltration when the server is deployed without API key authentication. Attackers can abuse distributed weight broadcasting via NCCL - the same mechanism used for legitimate inter-GPU weight distribution - to redirect all model weights to an attacker-controlled destination, resulting in total confidentiality loss of what may be highly valuable proprietary ML assets. No public exploit code or CISA KEV listing is confirmed at time of analysis; EPSS at 0.19% (9th percentile) reflects low observed exploitation activity, consistent with this being a targeted threat against specialized ML infrastructure rather than opportunistic mass exploitation.
Unauthenticated credential leakage in SGLang's /server_info HTTP endpoint exposes configured API keys and SSL keyfile paths to any network-reachable caller on all versions through v0.5.15. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and SSVC classifies the attack as automatable with a proof-of-concept available, making mass scanning for exposed instances a realistic threat. EPSS sits at just 0.14% (4th percentile), reflecting SGLang's niche deployment footprint rather than any technical difficulty - for internet-facing deployments using --admin-api-key, this is a high-priority credential-rotation and patching event.
Remote code execution in SGLang (versions up to and including 0.5.15) allows attackers to run arbitrary code on the inference server by abusing the /update_weights_from_disk endpoint, which falls back to torch.load(..., weights_only=False) and thus deserializes attacker-controlled pickle streams embedded in .bin model-weight files. Because SGLang's HTTP serving API is typically exposed without authentication, an attacker able to reach the endpoint and influence the loaded weights path can achieve code execution as the serving process. This is a CWE-502 deserialization flaw rated CVSS 9.8; a vendor security advisory (GHSA-wf98-gv64-5wrf) and a public technical disclosure exist, though EPSS remains low (0.26%, 18th percentile) and it is not in CISA KEV - no public exploit identified at time of analysis beyond the disclosure write-up.
Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the optional dumper subsystem, escaping the intended sandbox when DUMPER_SERVER_PORT is configured. The flaw is code injection (CWE-95) triggered via inference requests, carrying a CVSS 9.8 with SSVC noting proof-of-concept exploit code and automatable exploitation. Currently there is publicly available exploit code exists per the CERT/CC disclosure, though EPSS remains low at 0.17% (7th percentile), and it is not listed in CISA KEV.
Unauthenticated remote code execution in SGLang (versions 0 through 0.5.14) arises when the expert-parallel backup subsystem binds a ZeroMQ PULL socket to a routable interface without authentication or safe deserialization, letting a network attacker send a crafted pickle payload that executes arbitrary code in the serving process. It affects deployments where the elastic expert-parallel backup feature is enabled and the socket is reachable. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution in SGLang (the LLM/multimodal generation serving runtime) affecting version 5.10 arises when the non-default `--enable-custom-logit-processor` flag is set, allowing attacker-supplied Python objects to be deserialized via `dill.loads()` and execute arbitrary code on the inference host. No CISA KEV listing exists and SSVC records exploitation as 'none', but a public technical write-up (antiproof.ai, 'Three RCEs in SGLang') details the flaw and SSVC marks it automatable with total technical impact. EPSS is modest at 0.32% (55th percentile), consistent with a serious-but-conditional (feature-gated) issue rather than mass exploitation.
Arbitrary file write in SGLang's multimodal generation runtime (version 5.10) allows a remote, unauthenticated attacker to place files anywhere the server process can write by embedding ../ sequences in an upload filename sent to specific endpoints. Because the affected process typically runs LLM inference workloads, a written file can be leveraged toward code execution or service disruption. A public technical write-up describing multiple SGLang RCEs exists, though the EPSS probability is very low (0.07%) and the issue is not listed in CISA KEV.
Unauthenticated remote code execution affects SGLang, an LLM/multimodal inference-serving framework, at version 5.10, where the generation runtime scheduler's ZeroMQ ROUTER socket binds to 0.0.0.0 by default and deserializes incoming messages with pickle.loads(). Any attacker who can reach the exposed scheduler port can send a crafted pickle payload to execute arbitrary code on the host with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, though a vendor-independent technical writeup ('three RCEs in sglang') describes the flaw; EPSS is low (0.05%) and SSVC records no observed exploitation, but the issue is rated automatable with total technical impact.
Remote code execution in SGLang 0.5.9's /v1/rerank endpoint allows unauthenticated attackers to execute arbitrary code by loading specially crafted model files with malicious Jinja2 templates. The vulnerability stems from unsandboxed rendering of tokenizer.chat_template fields, enabling template injection attacks. Publicly available exploit code exists (GitHub POC by Stuub). With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and SSVC ratings of automatable with total technical impact, this represents critical risk for exposed SGLang deployments handling untrusted model files.
High severity vulnerability in SGLang. SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated RCE through pickle deserialization in the disaggregation module's inter-process communication. Same class of vulnerability as CVE-2026-3059 in a different code path.
SGLang's multimodal generation module deserializes untrusted data with pickle.loads() over an unauthenticated ZMQ broker, enabling remote code execution. Any attacker who can reach the ZMQ port can execute arbitrary Python code on the ML inference server.
Unauthenticated remote credential disclosure in SGLang (sgl-project/sglang) up to version 0.5.21, where the /server_info HTTP endpoint and the gRPC GetServerInfo path returned the entire ServerArgs dataclass and thereby exposed the configured api_key, admin_api_key, and ssl_keyfile_password values verbatim to any network-reachable caller. No privileges or user interaction are required (CVSS 4.0 vector PR:N/UI:N, with E:P indicating a proof-of-concept), and publicly available exploit code exists; KEV has not flagged this as actively exploited. Impact is confidentiality-only but potentially severe - a leaked admin API key gives full control of the inference service - with the practical gate being whether the operator actually configured a secret and left the management endpoint exposed. A vendor fix exists only as an unmerged pull request (PR #30343), so released patched versions could not be confirmed at analysis time.
Malformed ZeroMQ AUX_DATA control messages can terminate the Decode worker's control thread in SGLang 0 through 0.5.15, letting an unauthenticated attacker who can reach the Decode control PULL socket take the inference server offline. The flaw is a missing input-validation check on the control-message path (availability-only impact; no data exposure or code execution), and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H for a base score of 5.9. Exploitation is realistic only where the Decode control socket is exposed beyond localhost in disaggregated or multi-node deployments, which is why the attack complexity is rated High; no public exploit has been identified at time of analysis and the issue is not in CISA KEV.
Server-Side Request Forgery and local file read in SGLang's multimodal inference endpoint allows authenticated API users to exfiltrate cloud metadata, internal service responses, and secrets. The `/v1/chat/completions` endpoint accepts an `image_url` parameter that the server fetches without sanitization, enabling pivot to internal networks and cloud IMDS endpoints. Affecting all SGLang releases through v0.5.15, this is a high-confidentiality-impact flaw with no public exploit or CISA KEV listing identified at time of analysis, and an EPSS of 0.14% (4th percentile) suggesting limited opportunistic exploitation to date.
Hash collision weaknesses in SGLang's multimodal Cache Handler (all versions through 0.5.11) allow a local low-privilege attacker to craft multimodal tensor inputs that produce identical cache keys via truncated SHA256 digests, causing incorrect cache lookups or cache invalidation failures that disrupt LLM serving workflows. The CVSS 4.0 score of 1.1 reflects the strictly local attack vector and high exploitation complexity, limiting real-world impact primarily to multi-tenant inference deployments. Publicly available exploit code exists per GitHub issue #25462, though no confirmed active exploitation has been observed and the vulnerability is not listed in the CISA KEV catalog.
Reachable assertion in SGLang 0.5.10.post1's LoRA adapter scheduler allows a remote unauthenticated attacker to trigger a denial of service via a crafted `lora_path` argument to the inference HTTP endpoint. The root cause is a logic flaw in the batch prefill scheduler: chunked LoRA prefill requests already admitted to the prefill queue are invisible to the LoRA admission check, enabling N+1 distinct adapters to be submitted when `max_loras_per_batch=N`, which forces an assertion failure in `lora_manager.py`. A publicly available proof-of-concept exists (no public exploit identified at time of analysis in the KEV sense), and the CVSS 4.0 score of 2.9 reflects high attack complexity and limited availability impact.