CVE-2026-15978

The SGLang framework, an open-source tool for serving large language models, contains a model weight exfiltration vulnerability (CVE-2026-15978 ). When no API keys are configured, the framework exposes two endpoints that allow a remote attacker to trigger distributed weight broadcasting via NCCL ...

SGLang contains six different vulnerabilities including RCE, data exfiltration, and credential disclosure

Overview Six vulnerabilities have been discovered within the SGLang project, including remote code execution RCE, server-side request forgery SSRF, local file read, credential leakage, and model weight exfiltration on a target server. Exploitation does not require authentication in most cases, an...