Sglang Router
Monthly
Authorization bypass in sglang-router (sgl-model-gateway) through 0.3.2 allows an authenticated holder of a data-plane API key to reach the /ha/* mesh high-availability management routes that are meant to require the control-plane Admin role. Such a caller can read cluster topology, write gossiped configuration, modify global rate limits, and invoke POST /ha/shutdown to quietly dissolve HA coordination. Exploitation requires mesh/HA coordination mode to be deployed and a valid data-plane credential; no public exploit code has been identified at time of analysis, and a vendor patch is available.
Authorization bypass in sglang-router (sgl-model-gateway) through 0.3.2 allows an authenticated holder of a data-plane API key to reach the /ha/* mesh high-availability management routes that are meant to require the control-plane Admin role. Such a caller can read cluster topology, write gossiped configuration, modify global rate limits, and invoke POST /ha/shutdown to quietly dissolve HA coordination. Exploitation requires mesh/HA coordination mode to be deployed and a valid data-plane credential; no public exploit code has been identified at time of analysis, and a vendor patch is available.