CVE-2026-15978

SGLang contains a vulnerability where, if no API keys are configured, two exposed endpoints allow a remote attacker to trigger distributed weight broadcasting via NCCL and initiate data transfer, enabling exfiltration of all model weights. Affected component: SGLang; vulnerability type: model wei...