CVE-2026-14890
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
The vulnerability in SGLang involves an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface without authentication or deserialization safeguards. This allows an attacker to provide a malicious pickle file, resulting in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.
Risk Assessment
The risk to the organization includes the possibility of an unauthenticated attacker gaining full control over the system, potentially leading to data theft, service disruption, or further propagation of the attack within the network.
Recommendation
It is recommended to immediately disable the expert-parallel backup subsystem if not required, and apply security patches from the vendor. Additionally, restrict network access to the ZeroMQ PULL socket using a firewall.
Original NVD description (English source)
SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.