Executive brief
SGLang, a framework for serving large language models, contains a security vulnerability in its backup management component. An attacker can remotely execute unauthorized commands on the server because a network communication port lacks authentication and proper data validation. This could lead to a complete takeover of the AI serving infrastructure and exposure of sensitive model data.
Technical details
SGLang (up to version 0.5.14) exposes a ZeroMQ PULL socket via its expert-parallel backup subsystem on a routable network interface. This socket lacks authentication and fails to implement deserialization safeguards when processing incoming data. An attacker can send a maliciously crafted Python pickle file to this port, leading to unauthenticated remote code execution (RCE). The vulnerability is present when the expert-parallel backup feature is enabled and the service is network-accessible. Security engineers should ensure the service is not exposed to untrusted networks and update to a patched version if available.
Affected products
- SGLang Project SGLang <= 0.5.14
Timeline
- 2026-07-16: disclosed: Initial disclosure via NVD and CERT/CC
- 2026-07-16: advisory