CVE-2026-15978
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
SGLang contains a model weight exfiltration vulnerability when no API keys are configured. SGLang exposes two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then trigger data transfer, enabling exfiltration of all model weights.
Risk Assessment
Risk includes theft of intellectual property in the form of model weights, leading to confidentiality and competitive advantage breaches.
Recommendation
Configure API keys for SGLang and restrict access to endpoints to authorized users only.
Other vulnerabilities in SGLang
See all- CVE-2026-15976Critical
SGLang contains a remote code execution (RCE) vulnerability when loading model weights from a HuggingFace repository. In the /update_weights_from_disk endpoint, torch.load with weights_only=False allows pickle deserialization of .bin files.
- CVE-2026-15971Critical
SGLang contains a remote code execution (RCE) vulnerability in the optional dumper subsystem. When DUMPER_SERVER_PORT is set, a sandbox escape is possible, enabling code execution on inference requests.
- CVE-2026-15969Critical
SGLang contains an unauthenticated remote code execution (RCE) vulnerability in the /load_lora_adapter_from_tensors endpoint. It bypasses SafeUnpickler's incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.
- CVE-2026-14890Critical
The vulnerability in SGLang involves an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface without authentication or deserialization safeguards. This allows an attacker to provide a malicious pickle file, resulting in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.
- CVE-2026-15977High
SGLang contains a credential leakage vulnerability in the /server_info endpoint. When only the --admin-api-key is configured, this endpoint returns API keys and SSL keyfile information.
- CVE-2026-15974Medium
SGLang contains an SSRF and local file read vulnerability in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services.
- CVE-2026-10775Low
Vulnerability in SGLang up to version 0.5.11 in the data_hash function of the Cache Handler component causes denial of service (DoS) via a local attack with high complexity. Exploit has been published.
- CVE-2026-10300Low
In SGLang 0.5.10.post1, a reachable assertion vulnerability exists in the file python/sglang/srt/lora/lora_manager.py of the Inference HTTP Endpoint component via the lora_path argument. The attack is remote with high complexity, and an exploit has been disclosed.
Original NVD description (English source)
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.