Executive brief
SGLang, an open-source framework for serving Large Language Models (LLMs), contains a vulnerability that allows unauthorized users to steal proprietary model weights. When the software is configured without API keys—a common occurrence in certain containerized or internal environments—it exposes administrative endpoints to the network. An attacker can use these endpoints to force the server to transmit the entire AI model to a remote location they control, resulting in the loss of intellectual property and sensitive data.
Technical details
A vulnerability in SGLang's authentication logic and distributed control plane allows for model weight exfiltration. The software utilizes an 'ADMIN_OPTIONAL' authentication policy for administrative routes, which defaults to allowing all requests if no API keys are explicitly configured. By accessing exposed control routes (such as those managing distributed process groups), a remote unauthenticated attacker can trigger NCCL (NVIDIA Collective Communications Library) weight broadcasting. This allows the attacker to enroll an untrusted peer into the distributed cluster and initiate a data transfer of the complete model weights to an external receiver. The vulnerability affects versions up to and including v0.5.15.
Affected products
- SGLang Project SGLang <= v0.5.15
Timeline
- 2026-04-22: disclosed: Initial disclosure to maintainers via GitHub Security Advisories
- 2026-07-30: advisory: Public disclosure and CVE assignment via CERT/CC