CVE-2026-93034

CVE-2026-93034

SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Sglang

Products

Sglang

CVE-2026-94570

CVE-2026-94570

SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial of service against the target server.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sglang

Products

Sglang

CVE-2026-93088

CVE-2026-93088

SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Sglang

Products

Sglang

CVE-2026-86793

CVE-2026-86793

SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Sglang

Products

Sglang

CVE-2026-15978

CVE-2026-15978

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-15971

CVE-2026-15971

SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-15976

CVE-2026-15976

SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-15974

CVE-2026-15974

SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-15977

CVE-2026-15977

SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-15969

CVE-2026-15969

SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-14890

CVE-2026-14890

SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-5760

CVE-2026-5760

SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment().

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-10300

SGLang Inference HTTP Endpoint lora_manager.py assertion

A security vulnerability has been detected in SGLang 0.5.10.post1. Impacted is an unknown function of the file python/sglang/srt/lora/lora_manager.py of the component Inference HTTP Endpoint. Such manipulation of the argument lora_path leads to reachable assertion. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sgl-project Sglang

Products

Sglang Sglang

CVE-2026-7301

CVE-2026-7301

SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages, enabling RCE when exposed to the internet.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-7302

CVE-2026-7302

SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-7304

CVE-2026-7304

SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads() will be deserialized without validation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-3989

CVE-2026-3989

SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-3060

CVE-2026-3060

SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-3059

CVE-2026-3059

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang