# CVE-2026-92972: SGLang unauthenticated PUT /route endpoint KV transfer poisoning

Source: https://junglewise.ai/threats/cve-2026-92972-sglang-unauthenticated-put-route-endpoint-kv-transfer-poisoning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92972 · Severity: high · CVSS 8.6 · Published 2026-09-17

SGLang is a high-performance serving framework for large language models. In prefill/decode disaggregation mode, an unauthenticated endpoint allows attackers to poison the routing table used for KV cache transfers between prefill and decode workers. This enables attackers to redirect worker communications to attacker-controlled servers, causing service disruption or exposing sensitive metadata about model topology and session identifiers.

Technologies: [SGLang Project SGLang](https://junglewise.ai/threats/technologies/sglang). Vendors: [SGLang Project](https://junglewise.ai/threats/vendors/sglang-project).

## Quick answers

**Is CVE-2026-92972 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92972 being exploited in the wild.

**How severe is CVE-2026-92972?** High severity, with a CVSS score of 8.6, published 17 September 2026.

**Which products and versions are affected?** SGLang Project SGLang through 0.5.19.

**Is there a fix for CVE-2026-92972?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92972 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92972?** Check whether you run SGLang Project SGLang at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SGLang through version 0.5.19 exposes an unauthenticated PUT /route endpoint on the prefill bootstrap service in disaggregation mode. The vulnerability is a missing authentication/authorization check on a routing configuration endpoint. Attackers with network access to the prefill bootstrap service can supply arbitrary rank_ip and rank_port values to poison the KV transfer routing table. This allows redirection of decode worker connections to attacker-controlled endpoints, leading to denial of service, disclosure of KV transfer metadata (including session identifiers and tensor-parallel topology parameters), or man-in-the-middle attacks on KV cache transfers. A fix is available in versions after 0.5.19.

## Affected products

- SGLang Project SGLang through 0.5.19

## Timeline

- 2026-09-17: disclosed

## References

- [https://github.com/sgl-project/sglang](https://github.com/sgl-project/sglang)
- [https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/disaggregation/common/conn.py](https://github.com/sgl-project/sglang/blob/v0.5.19/python/sglang/srt/disaggregation/common/conn.py)

## Related threats

- [SGLang uncontrolled memory allocation in Mooncake disaggregation backend](https://junglewise.ai/threats/cve-2026-112270-sglang-through-0-5-22-with-the-mooncake-disaggregation-backend)
- [SGLang Mooncake disaggregation backend unauthenticated denial of service](https://junglewise.ai/threats/cve-2026-112269-sglang-through-0-5-22-with-the-mooncake-disaggregation-backend)
- [SGLang server-side request forgery in prefill/decode disaggregation](https://junglewise.ai/threats/cve-2026-112267-sglang-through-0-5-22-in-prefill-decode-disaggregation-mode)
- [SGLang cache poisoning via untrusted mm_hashes in multimodal prefix cache](https://junglewise.ai/threats/cve-2026-111392-sglang-through-0-5-21-trusts-caller-supplied-mm-hashes-values-as)
- [SGLang code injection in _evaluate_filter()](https://junglewise.ai/threats/cve-2026-111391-sglang-0-5-10-through-0-5-22-contains-a-code-injection)