Executive brief
SGLang is a high-performance serving framework for large language models. In prefill/decode disaggregation mode, an unauthenticated endpoint allows attackers to poison the routing table used for KV cache transfers between prefill and decode workers. This enables attackers to redirect worker communications to attacker-controlled servers, causing service disruption or exposing sensitive metadata about model topology and session identifiers.
Technical details
SGLang through version 0.5.19 exposes an unauthenticated PUT /route endpoint on the prefill bootstrap service in disaggregation mode. The vulnerability is a missing authentication/authorization check on a routing configuration endpoint. Attackers with network access to the prefill bootstrap service can supply arbitrary rank_ip and rank_port values to poison the KV transfer routing table. This allows redirection of decode worker connections to attacker-controlled endpoints, leading to denial of service, disclosure of KV transfer metadata (including session identifiers and tensor-parallel topology parameters), or man-in-the-middle attacks on KV cache transfers. A fix is available in versions after 0.5.19.
Affected products
- SGLang Project SGLang through 0.5.19
Timeline
- 2026-09-17: disclosed