SGLang flaws allow unpatched RCE, weight theft

Six unpatched SGLang vulnerabilities let unauthenticated attackers achieve remote code execution, steal credentials, and exfiltrate LLM model weights.

Researchers disclosed six vulnerabilities in SGLang, an open-source LLM serving framework used with models like Qwen, DeepSeek, Mistral, and Skywork. The flaws span unauthenticated remote code execution via incomplete pickle deserialization filtering, sandbox escape through an optional debugging subsystem, SSRF and local file read via unsanitized image URL input in the multimodal chat completions endpoint, RCE through unsafe torch.load deserialization when pulling model weights from HuggingFace, credential leakage exposing API keys and SSL keyfile data, and a distributed weight exfiltration path abusing NCCL broadcasting when no API keys are configured.

Exploitation generally requires no authentication and, in several cases, only network access to the exposed service. CERT/CC notes that coordination attempts with SGLang maintainers were unsuccessful and no patches are currently available, leaving affected deployments exposed. The maintainers have acknowledged prior pickle deserialization issues (referencing CVE-2026-14890) and are working toward a msgpack-based refactor, but the vulnerable SGLANG_USE_PICKLE_IPC setting still defaults to enabled.

Given the lack of patches, organizations running SGLang-based inference services should treat any internet- or untrusted-network-facing deployment as high risk. Recommended mitigations include restricting network access to service interfaces, enforcing segmentation, disabling unused endpoints, and setting SGLANG_USE_PICKLE_IPC to false. The combination of unauthenticated RCE and model weight exfiltration capability makes this a significant concern for any organization hosting proprietary or sensitive models via SGLang.

title: Shell Process Spawned from SGLang Inference Server
description: Detects cmd/powershell/bash/sh being launched as a child of a Python
  process hosting SGLang, consistent with post-exploitation of the unauthenticated
  pickle deserialization or torch.load RCE vulnerabilities. SGLang server processes
  should not normally spawn interactive shells.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \python.exe
    - \python3.exe
    ParentCommandLine|contains:
    - sglang
    - sgl_kernel
    - sgl-kernel
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \bash.exe
    - \sh.exe
    - \wsl.exe
  condition: selection_parent and selection_child
falsepositives:
- Developers debugging SGLang from an interactive shell that itself is a Python child
  process
- Custom deployment scripts that shell out from within the serving process for legitimate
  maintenance
level: high
id: 419f12db-6599-5c9d-bec5-7cd0a60929a5
status: experimental
author: Vorant

title: SGLang Chat Completions Endpoint SSRF or Local File Read Attempt
description: Detects HTTP requests to an SGLang multimodal chat completions endpoint
  where the image_url parameter references file:// paths, loopback/link-local addresses,
  or cloud metadata IPs, matching the disclosed unsanitized image URL SSRF/LFI vulnerability.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
    - /chat/completions
    - /v1/chat/completions
  selection_payload:
    cs-uri-query|contains:
    - image_url=file://
    - image_url=http://127.0.0.1
    - image_url=http://169.254.169.254
    - image_url=http://localhost
    - image_url=http%3a%2f%2f169.254.169.254
  condition: selection_endpoint and selection_payload
falsepositives:
- Internal testing of the multimodal endpoint using local sample images referenced
  by loopback URLs
- Automated vulnerability scanning by the organization's own security team
level: high
id: 0a198d98-9076-55b6-9136-76a27b019a5d
status: experimental
author: Vorant

title: SGLang Process Outbound NCCL Connection to External Address
description: Detects a Python/SGLang server process initiating outbound network connections
  on default NCCL communication ports to public (non-RFC1918) destinations, consistent
  with abuse of unauthenticated NCCL broadcasting to exfiltrate model weights when
  no API keys are configured.
tags:
- attack.exfiltration
- attack.t1041
- attack.command-and-control
- attack.t1090
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \python.exe
    - \python3.exe
    Initiated: 'true'
    DestinationPort:
    - 29400
    - 29500
    - 29501
    - 29502
  filter_private:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
  condition: selection and not filter_private
falsepositives:
- Legitimate multi-node distributed training/inference clusters that span public cloud
  regions without VPC peering
- NCCL-based workloads intentionally exposed across sites for federated inference
level: medium
id: 772b9e53-e3f9-55a8-ba4f-baeaea4c3f01
status: experimental
author: Vorant

Source reporting: https://kb.cert.org/vuls/id/281278