SGLang RCE and path traversal in multimodal mode
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Three vulnerabilities in SGLang LLM framework enable RCE and file writes; no patch available, restrict network access.
Three vulnerabilities have been discovered in SGLang, an open-source framework for serving large language models and multimodal AI models. Two vulnerabilities enable remote code execution: CVE-2026-7301 exploits unsafe pickle deserialization in the multimodal generation runtime scheduler's ROUTER socket, which binds to 0.0.0.0 by default and is exposed to the internet without authentication; CVE-2026-7304 allows RCE when the --enable-custom-logit-processor option is enabled through unsafe dill.loads() deserialization. CVE-2026-3060 and CVE-2026-3059 describe a ZMQ broker that automatically binds to all network interfaces without user awareness. CVE-2026-7302 is a path traversal vulnerability in the multimodal generation runtime that allows unauthenticated arbitrary file writes via ../ sequences in upload filenames. All vulnerabilities require the multimodal generation mode to be enabled and network access to the SGLang service. No patch is currently available, and the maintainers have not responded to coordination efforts. Until patches are released, users should restrict network access to SGLang interfaces, implement network segmentation, and ensure services are not exposed to untrusted networks.
Mentioned in this report
Detection guidance
Shell or Download Utility Spawned by SGLang Server Process
Detects a shell, download tool or netcat spawned by a python process whose command line references sglang, consistent with RCE via unsafe pickle/dill deserialization. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell or Download Utility Spawned by SGLang Server Process
description: Detects shells, download utilities or netcat spawned as children of a
python process running SGLang. Consistent with post-exploitation of unsafe pickle/dill
deserialization RCE (CVE-2026-7301, CVE-2026-7304) in the SGLang multimodal runtime.
Matches the parent/child relation, not specific payloads.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentCommandLine|contains: sglang
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /zsh
- /curl
- /wget
- /nc
- /ncat
- /socat
condition: selection_parent and selection_child
falsepositives:
- Operators launching SGLang through a wrapper shell script that matches the parent
command line
- Container health-check scripts calling curl from within the SGLang process tree
level: high
id: 85294dc3-9d0c-5bc7-82cd-79212bfdde9f
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/777338
Python Process Writing Persistence or Auth Files (Arbitrary File Write)
Detects a python process creating files in SSH authorized_keys, cron or ld.so.preload locations, consistent with exploitation of unauthenticated arbitrary file write via ../ in upload filenames (CVE-2026-7302). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Python Process Writing Persistence or Auth Files (Arbitrary File Write)
description: Detects python processes creating or modifying files in sensitive locations
such as authorized_keys, cron directories, ld.so.preload or shell profile files.
Consistent with abuse of the SGLang multimodal upload path traversal (CVE-2026-7302)
for arbitrary file write. Hunt on hosts running AI model serving workloads.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection_image:
Image|contains: /python
selection_target:
TargetFilename|endswith:
- /.ssh/authorized_keys
- /etc/ld.so.preload
- /.bashrc
- /.profile
TargetFilename|contains:
- /etc/cron
- /var/spool/cron
condition: selection_image and selection_target
falsepositives:
- Configuration management or provisioning scripts written in python that manage SSH
keys or cron entries
- Python-based installers modifying shell profiles
level: medium
id: a5403b96-0ac1-5227-abf4-40e9881a0c26
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/777338
SGLang Child Process Accessing Credentials or Container Socket
Detects a child of an SGLang python process reading credential files, process environment or the Docker socket, indicating post-exploitation credential theft or container escape attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SGLang Child Process Accessing Credentials or Container Socket
description: Detects commands spawned from a process whose parent command line references
sglang that touch cloud credential files, SSH keys, kube config, process environment
variables or the Docker socket. Indicates post-RCE credential harvesting or container
escape attempts following exploitation of SGLang deserialization flaws.
tags:
- attack.credential-access
- attack.t1552
- attack.privilege-escalation
- attack.t1611
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentCommandLine|contains: sglang
selection_cmd:
CommandLine|contains:
- .aws/credentials
- /.ssh/id_
- .kube/config
- /proc/self/environ
- /environ
- docker.sock
- /etc/shadow
condition: selection_parent and selection_cmd
falsepositives:
- Administrators debugging a container by shelling in from an SGLang-launched process
tree
- Backup or monitoring agents started under the SGLang service wrapper
level: high
id: ca62c2b3-d3b4-5545-b0e8-df092e5e8a62
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/777338
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/777338
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs