CVE-2026-7669-PoC

CVE-2026-7669 SGLang silently overrides trustremotecode=False to True and re-invokes AutoTokenizer.frompretrained whenever transformers v5 returns a TokenizersBackend object. A model with a custom tokenizerclass and an automap pointing at tokenizer.py reaches arbitrary code execution inside the...

SGLang-0.5.9-RCE

SGLang SSTI to RCE PoC — Unsandboxed Jinja2 Chat Template Rendering CVE-2026-5760 Remote Code Execution via Server-Side Template Injection SSTI in SGLang's reranking endpoint. A malicious GGUF model file with a crafted tokenizer.chattemplate achieves arbitrary code execution when loaded into SGLa...

chatml-role-token-probe

chatml-role-token-probe Prove your agent stack is vulnerable to role-forgery — before an attacker does. A drop-in probe that fires a corpus of ChatML / Mistral / Llama control-token literals at your self-hosted agent stack's untrusted-text path and reports whether the tokenizer or server turns th...

SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users

An attacker exploited a remote code execution flaw in SGLang , an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the...

python313-sglang-0.5.21-2.1 on GA media (moderate)

python313-sglang-0.5.21-2.1 on GA media Announcement ID: openSUSE-SU-2026:12118-1 Rating: moderate Cross-References: CVE-2026-105245 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

SUSE CVE-2026-112266

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

SUSE CVE-2026-112267

SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstraphost and bootstrapport fields. Attackers sending crafted requests to the Decode worker's...

SUSE CVE-2026-112269

SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncakesessionid values and large nested-buffer...

SUSE CVE-2026-112270

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...

SUSE CVE-2026-111392

SGLang through 0.5.21 trusts caller-supplied mmhashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or...

CVE-2026-112267

SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstraphost and bootstrapport fields. Attackers sending crafted requests to the Decode worker's...

CVE-2026-112268

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

CVE-2026-112269

SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations with unique mooncakesessionid values and large nested-buffer...

CVE-2026-112270

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...

CVE-2026-112266

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

EUVD-2026-104303

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...

CVE-2026-112270

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...

CVE-2026-112270 SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...

CVE-2026-112270 SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handlestagingrsp that lets unauthenticated network-adjacent attackers exhaust Prefill memory. Attackers can obtain the rank address from the /route endpoint and send STAGINGR...

CVE-2026-112270

Versions of SGLang up to and including 0.5.22 using the Mooncake disaggregation backend are vulnerable to an uncontrolled memory allocation vulnerability within the handle_staging_rsp() function. An unauthenticated network-adjacent attacker can exhaust Prefill memory by first obtaining a rank add...