SGLang flaws allow unpatched RCE, weight theft

Six unpatched SGLang vulnerabilities let unauthenticated attackers achieve remote code execution, steal credentials, and exfiltrate LLM model weights.

Researchers disclosed six vulnerabilities in SGLang, an open-source LLM serving framework used with models like Qwen, DeepSeek, Mistral, and Skywork. The flaws span unauthenticated remote code execution via incomplete pickle deserialization filtering, sandbox escape through an optional debugging subsystem, SSRF and local file read via unsanitized image URL input in the multimodal chat completions endpoint, RCE through unsafe torch.load deserialization when pulling model weights from HuggingFace, credential leakage exposing API keys and SSL keyfile data, and a distributed weight exfiltration path abusing NCCL broadcasting when no API keys are configured.

Exploitation generally requires no authentication and, in several cases, only network access to the exposed service. CERT/CC notes that coordination attempts with SGLang maintainers were unsuccessful and no patches are currently available, leaving affected deployments exposed. The maintainers have acknowledged prior pickle deserialization issues (referencing CVE-2026-14890) and are working toward a msgpack-based refactor, but the vulnerable SGLANG_USE_PICKLE_IPC setting still defaults to enabled.

Given the lack of patches, organizations running SGLang-based inference services should treat any internet- or untrusted-network-facing deployment as high risk. Recommended mitigations include restricting network access to service interfaces, enforcing segmentation, disabling unused endpoints, and setting SGLANG_USE_PICKLE_IPC to false. The combination of unauthenticated RCE and model weight exfiltration capability makes this a significant concern for any organization hosting proprietary or sensitive models via SGLang.

Source reporting: https://kb.cert.org/vuls/id/281278