# SGLang expert-backup flaw enables unauth RCE

Published: 2026-07-16 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/56868fa0-f1ee-5636-b9e4-b2f5035c118a/sglang-expert-backup-flaw-enables-unauth-rce

> An unauthenticated Pickle deserialization flaw in SGLang's expert-parallel backup subsystem allows remote code execution when the feature is enabled and reachable over the network.

A vulnerability tracked as CVE-2026-14890 has been disclosed in SGLang, an open-source LLM serving framework used with models like Qwen, DeepSeek, Mistral, and Skywork. The flaw lies in the expert-parallel backup subsystem's expert_backup_manager.py, which binds a ZeroMQ PULL socket to a routable network interface without authentication or deserialization safeguards. Any network-reachable attacker can send a malicious pickle payload that is deserialized via pickle.loads(), resulting in unauthenticated remote code execution.

This issue is structurally similar to two previously disclosed SGLang deserialization vulnerabilities, CVE-2026-7301 and CVE-2026-7304, which affected the multimodal scheduler and custom logit processor interfaces respectively. No patch is currently available, and the SGLang maintainers did not respond during the coordination process. The SGLANG_USE_PICKLE_IPC setting defaults to true, meaning affected deployments are vulnerable out of the box unless manually reconfigured.

Exploitation requires the expert-parallel backup feature to be enabled and the vulnerable endpoint to be reachable over the network, meaning risk is highest for deployments exposing this interface to untrusted networks. Recommended mitigations include restricting network access to the service, implementing segmentation, and setting SGLANG_USE_PICKLE_IPC to false in environ.py until a fix is released. The maintainers are reportedly working toward a longer-term refactor to msgpack to eliminate this class of pickle-based deserialization issues.

## Mentioned in this report

- Vulnerabilities: CVE-2026-14890, CVE-2026-7301, CVE-2026-7304

## Detection guidance (public sample)

### Suspicious Shell Spawned by Python-based LLM Serving Process (SGLang RCE)

ATT&CK: T1059

Detects a shell or scripting interpreter spawned as a child of a Python process (as used by SGLang serving frameworks), consistent with post-exploitation command execution following unauthenticated pickle deserialization RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Shell Spawned by Python-based LLM Serving Process
description: Detects cmd.exe, powershell.exe, or POSIX shells spawned directly from
  a python/python3 process, which is anomalous for LLM serving frameworks like SGLang
  and consistent with command execution following successful exploitation of an unauthenticated
  pickle deserialization vulnerability (e.g. CVE-2026-14890 in expert_backup_manager.py).
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \python.exe
    - \python3.exe
    - \pythonw.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \bash.exe
    - \sh.exe
  filter_dev_tooling:
    CommandLine|contains:
    - jupyter
    - pytest
    - conda
  condition: selection and not filter_dev_tooling
falsepositives:
- Data science notebooks or build/test tooling that legitimately shells out from Python
- Administrative scripts that invoke python then a shell for automation
level: high
id: 89367214-25e2-5c2e-a87c-8041bfbd64fd
status: experimental
author: Vorant
```

### Shell Spawned from Python Process on Linux (Potential SGLang Deserialization RCE)

ATT&CK: T1059.004

Detects /bin/sh or /bin/bash launched as a direct child of a python interpreter process on Linux hosts, matching the expected post-exploitation behavior of the SGLang expert-parallel backup pickle deserialization RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shell Spawned from Python Process on Linux
description: Detects a shell process (sh/bash) spawned directly by a python or python3
  interpreter on Linux, which is unusual for a running LLM inference server such as
  SGLang and may indicate command execution achieved via an unauthenticated ZeroMQ
  pickle deserialization RCE (CVE-2026-14890) against the expert-parallel backup subsystem.
tags:
- attack.execution
- attack.t1059.004
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /python
    - /python3
    Image|endswith:
    - /sh
    - /bash
    - /dash
  filter_known_wrappers:
    CommandLine|contains:
    - pip
    - virtualenv
    - conda
    - setup.py
  condition: selection and not filter_known_wrappers
falsepositives:
- Container entrypoints or supervisor scripts that use python to launch shell wrappers
- CI/CD pipelines invoking shell commands from python build scripts
level: high
id: 0cf67762-7e9d-5825-842d-8744f3ec7845
status: experimental
author: Vorant
```

### Unauthenticated Inbound Connection to Uncommonly-Bound Python Server Port (Potential SGLang PULL Socket Exploitation)

ATT&CK: T1190

Detects a python/sglang server process accepting a new inbound network connection on a non-standard high port shortly followed by process spawning, consistent with exploitation of the unauthenticated ZeroMQ PULL socket used by SGLang's expert-parallel backup subsystem; intended as a lower-confidence hunting rule due to lack of fixed ports/paths in the report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Inbound Connection to Python Server Process Followed by Child Process Creation
description: Flags cases where a python-based server process (e.g. sglang) that accepted
  an inbound network connection then spawns a child process, which may indicate remote
  code execution via an unauthenticated deserialization vulnerability such as CVE-2026-14890
  in SGLang's expert-parallel backup ZeroMQ PULL socket. Because the report gives
  no fixed port or path, this is a broad hunting rule and should be tuned to the deployment's
  known SGLang listener ports.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /python
    - /python3
    ParentCommandLine|contains:
    - sglang
    - expert_backup
  filter_common:
    Image|endswith:
    - /python
    - /python3
  condition: selection and not filter_common
falsepositives:
- Legitimate SGLang worker processes spawning helper subprocesses as part of normal
  expert-parallel operation
- Monitoring or health-check agents that exec into the SGLang server process
level: medium
id: f24098b8-5166-54d8-ac6d-28380bb09fd0
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/326070

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/56868fa0-f1ee-5636-b9e4-b2f5035c118a/sglang-expert-backup-flaw-enables-unauth-rce.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup