CVE-2026-15978: SGLang model weight exfiltration via untrusted distributed peer enrollment

CVE-2026-15978 · Severity: info · CVSS 7.5 · Published 2026-07-30

SGLang, an open-source framework for serving Large Language Models (LLMs), contains a vulnerability that allows unauthorized users to steal proprietary model weights. When the software is configured without API keys—a common occurrence in certain containerized or internal environments—it exposes administrative endpoints to the network. An attacker can use these endpoints to force the server to transmit the entire AI model to a remote location they control, resulting in the loss of intellectual property and sensitive data.

Technologies: SGLang Project SGLang. Vendors: SGLang Project.

Quick answers

Is CVE-2026-15978 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-15978 being exploited in the wild.
How severe is CVE-2026-15978?
Informational severity, with a CVSS score of 7.5, published 30 July 2026.
Which products and versions are affected?
SGLang Project SGLang <= v0.5.15.
Is there a fix for CVE-2026-15978?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15978 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-15978?
Check whether you run SGLang Project SGLang at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in SGLang's authentication logic and distributed control plane allows for model weight exfiltration. The software utilizes an 'ADMIN_OPTIONAL' authentication policy for administrative routes, which defaults to allowing all requests if no API keys are explicitly configured. By accessing exposed control routes (such as those managing distributed process groups), a remote unauthenticated attacker can trigger NCCL (NVIDIA Collective Communications Library) weight broadcasting. This allows the attacker to enroll an untrusted peer into the distributed cluster and initiate a data transfer of the complete model weights to an external receiver. The vulnerability affects versions up to and including v0.5.15.

Affected products

  • SGLang Project SGLang <= v0.5.15

Timeline

  • 2026-04-22: disclosed: Initial disclosure to maintainers via GitHub Security Advisories
  • 2026-07-30: advisory: Public disclosure and CVE assignment via CERT/CC

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.