CISA lists SGLang vulnerabilities tied to RCE and credential leaks

SGLang contains multiple vulnerabilities that can enable remote code execution, server-side request forgery, local file read, credential leakage, and model weight exfiltration. For several issues, exploitation does not require authentication, and some require only network access without API keys or user credentials. The highest-level impact described is remote code execution, along with data exfiltration or arbitrary file overwrite on the host running SGLang.

The vulnerabilities are tracked as CVE-2026-15969, CVE-2026-15971, CVE-2026-15974, CVE-2026-15976, CVE-2026-15977, and CVE-2026-15978. CVE-2026-15969 is unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution using crafted base64-encoded pickle payloads. CVE-2026-15971 is RCE when the optional dumper subsystem is enabled, which allows a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests. CVE-2026-15974 is SSRF and local file read in /v1/chat/completions due to unsanitized image_url input, allowing access to internal metadata, secrets, and services. CVE-2026-15976 is RCE when loading model weights from a HuggingFace repository in /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files. CVE-2026-15977 is credential leakage in /server_info, returning API keys and SSL keyfile information when only the --admin-api-key is configured. CVE-2026-15978 is model weight exfiltration when no API keys are configured, where SGLang exposes two endpoints for a remote attacker to trigger distributed weight broadcasting using NCCL and then trigger data transfer, allowing exfiltration of all model weights.

If exploited, the vulnerabilities could allow an unauthenticated attacker to achieve remote code execution, exfiltrate model weights, or overwrite arbitrary files on the host machine running SGLang. Deployments that expose the affected interface to untrusted networks are described as having the highest risk of exploitation.

At the time of publication, no patches were available from the project maintainers, and coordination attempts have been unsuccessful. Until a patch is available, the advisory lists mitigations that include restricting access to the service interfaces and ensuring they are not exposed to untrusted networks, implementing network segmentation and access controls to prevent unauthorized interaction with the vulnerable endpoints, changing SGLANG_USE_PICKLE_IPC to “false” within environ.py, and disabling endpoints not in use to remove potential attack vectors. The advisory also states that maintainers have begun addressing pickle deserialization vulnerabilities and are working to refactor the code base with msgpack to prevent deserialization issues such as CVE-2026-14890, while noting that SGLANG_USE_PICKLE_IPC defaults to true within the codebase at the time of writing.

The guidance presented is that these issues affect SGLang and are tracked under the six CVE identifiers listed in the advisory, covering unauthenticated RCE, RCE under dumper configuration, SSRF and local file read in /v1/chat/completions, RCE during HuggingFace weight loading, credential leakage in /server_info, and model weight exfiltration when no API keys are configured. The advisory also provides the specific endpoint paths and conditions tied to each CVE, and it states that the project maintainers have not yet released patches for users at the time of publication.