Executive brief
SGLang, an open-source framework for serving Large Language Models (LLMs), contains a security flaw where sensitive credentials can be exposed. The system's information endpoint incorrectly shares administrative API keys and SSL certificate passwords with unauthorized users. An attacker who can reach the server over the network could use this information to gain full administrative control over the AI model server or intercept encrypted traffic.
Technical details
A credential leakage vulnerability exists in SGLang's '/server_info' and '/get_server_info' endpoints due to improper authorization checks and over-broad data serialization. The root cause is twofold: first, the endpoint lacks an explicit '@auth_level' decorator, causing the middleware to default to 'AuthLevel.NORMAL', which does not restrict access when only an '--admin-api-key' is configured. Second, the endpoint serializes the entire server configuration object using 'dataclasses.asdict(server_args)', which includes sensitive fields like 'api_key', 'admin_api_key', and 'ssl_keyfile_password'. An unauthenticated attacker can exploit this to retrieve the administrative API key, subsequently gaining full access to administrative routes and management functions.
Affected products
- SGLang Project SGLang <= v0.5.15
Timeline
- 2026-04-22: disclosed: Initial disclosure to maintainers via GitHub Security Advisories.
- 2026-07-30: advisory: Public disclosure and CERT/CC coordination.