GCVE-110-CERTCC-2026-281278

### Overview Six vulnerabilities have been discovered within the SGLang project, including remote code execution (RCE), server-side request forgery (SSRF), local file read, credential leakage, and model weight exfiltration on a target server. Exploitation does not require authentication in most cases, and some vulnerabilities require only network access with no API keys or user credentials. At the time of publication, no patches are available from the project maintainers, and coordination attempts have been unsuccessful. ### Description SGLang is an open-source framework for serving large language models (LLMs) and multimodal AI models, supporting models such as Qwen, DeepSeek, Mistral, and Skywork, and is compatible with OpenAI APIs. Six vulnerabilities have been discovered within the tool and are tracked as follows: **CVE-2026-15969** SGLang contains unauthenticated RCE in `/load_lora_adapter_from_tensors` by bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads. **CVE-2026-15971** SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, which allows for a sandbox escape when `DUMPER_SERVER_PORT` is set, enabling code execution on inference requests. **CVE-2026-15974** SGLang contains an SSRF and local file read in the multimodal generation endpoint `/v1/chat/completions` because `image_url` input is unsanitized, allowing access to internal metadata, secrets, and services. **CVE-2026-15976** SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the `/update_weights_from_disk`, where `torch.load(..., weights_only=False)` fallback enables pickle deserialization of `.bin` files. **CVE-2026-15977** SGLang contains a credential leakage vulnerability in the `/server_info` endpoint, which returns API keys and SSL keyfile information when only the `--admin-api-key` is configured. **CVE-2026-15978** SGLang contains a model weight exfiltration vulnerability when no API keys are configured, because SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights. ### Impact If exploited, these vulnerabilities could allow an unauthenticated attacker to achieve remote code execution, exfiltrate model weights, or overwrite arbitrary files on the host machine running SGLang. Deployments that expose the affected interface to untrusted networks are at the highest risk of exploitation. ### Solution Until a patch is available, affected users should consider the following mitigations: #### Mitigations * Restrict access to the service interfaces and ensure they are not exposed to untrusted networks. * Implement network segmentation and access controls to prevent unauthorized interaction with the vulnerable endpoints. * Change `SGLANG_USE_PICKLE_IPC` to "false" within `environ.py`. * Disable endpoints not in use to remove potential attack vectors. The SGLang maintainers have begun addressing pickle deserialization vulnerabilities and are working to refactor the code base with `msgpack` to prevent deserialization issues such as CVE-2026-14890, but the `SGLANG_USE_PICKLE_IPC` defaults to `true` within the codebase at the time of writing. ### Acknowledgements Thanks to the reporter, Apoorv Dayal [apoorvdayal@outlook.com]. This document was written by Christopher Cullen.