SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s…

CVE-2026-15969 is an unauthenticated remote code execution vulnerability in SGLang, a high-performance open-source framework for serving large language models that now powers over 400,000 GPUs globally. The flaw lives in the /load_lora_adapter_from_tensors HTTP API endpoint, which accepts base64-encoded pickle data. A SafeUnpickler class was introduced to restrict dangerous deserialization, but its denylist is incomplete — attackers can craft pickle opcodes that bypass the filter entirely and achieve arbitrary command execution on the host. All versions of SGLang with this endpoint are affected. No patch exists as of 2026-08-06.

The vendor-assigned CVSS 9.8 CRITICAL is accurate and, if anything, undersells the operational risk. The attack requires zero authentication, zero user interaction, and low complexity — just a single HTTP POST. SGLang's default launch guidance (--host 0.0.0.0) encourages binding to all interfaces, and authentication is optional and off by default. The SafeUnpickler that was supposed to mitigate earlier pickle CVEs (like CVE-2025-10164) has proven to be security theater for this code path. This is one of six simultaneously disclosed CVEs (CERT/CC VU#281278) with no vendor coordination — the maintainers did not respond. The combination of trivial exploitation, no authentication, no patch, and a rapidly growing install base makes the CRITICAL rating fully justified.

Why this verdict

• Trivial exploitation, zero auth: The attack is a single HTTP POST with a base64-encoded pickle payload. No credentials, no user interaction, no complex race condition. This is as low-friction as network RCE gets.
• No patch available: As of 2026-08-06, the SGLang maintainers have not responded to CERT/CC coordination and no fix has been released. Defenders cannot remediate — only mitigate. This is effectively a disclosed 0-day.
• SafeUnpickler is broken by design: The denylist approach to pickle deserialization is a known anti-pattern. Pickle's opcode flexibility means denylists are always incomplete. The 'fix' for the prior CVE-2025-10164 created a false sense of security.
• Role multiplier: SGLang is canonically deployed on GPU nodes serving AI inference workloads. These nodes frequently (a) run containers with elevated/privileged access for GPU passthrough, (b) hold proprietary model weights worth significant IP value, (c) store cloud credentials and HuggingFace tokens in environment variables, and (d) sit on internal networks with lateral movement potential. While SGLang is not in the identity/hypervisor/PAM high-value catalog, compromise of an AI serving tier enables model IP theft, compute hijacking (LLMjacking at $10K+/day GPU cost), and pivot into the broader network. For organizations deploying SGLang, these nodes ARE high-value infrastructure by definition — the blast radius is host-to-tier, not host-only.
• Growing attack surface: The AI inference ecosystem is under active reconnaissance by threat actors. 320K+ exposed AI services were found in June 2026 Shodan sweeps, with LLMjacking campaigns documented by CSA and Sysdig. SGLang's install base is growing rapidly.

Why not higher?

A CVSS 9.8 is already near the theoretical maximum. The only reason this isn't 10.0 is the Scope remains Unchanged (S:U) — the vulnerability compromises the SGLang host but doesn't automatically grant cross-boundary access (e.g., hypervisor escape). The blast radius, while severe for the AI tier, requires additional lateral movement to reach domain-level or fleet-level compromise.

Why not lower?

Downgrading would require evidence that the vulnerable endpoint is unreachable in real deployments, but SGLang's default configuration binds to all interfaces without authentication. The lack of any vendor patch eliminates the standard 'just patch it' mitigation path. The pickle denylist bypass is a fundamental design flaw, not a narrow edge case. Even if most SGLang instances sit behind a gateway, the ones that don't are fully exposed to trivial, unauthenticated RCE.

1. Block /load_lora_adapter_from_tensors at the reverse proxy or WAF immediately — Add a deny rule for any request to this endpoint path in your reverse proxy (nginx, Envoy, Traefik) or WAF. This is the single most effective mitigation — it removes the attack surface entirely without affecting normal inference operations. Deploy within the noisgate CRITICAL mitigation SLA of 3 days.
2. Place SGLang behind an authenticating API gateway — Deploy an API gateway (Kong, Bifrost, AWS API Gateway) in front of SGLang that enforces API key or mTLS authentication on all endpoints. SGLang should never be directly exposed. This should be a permanent architectural control, not just a mitigation. Deploy within 3 days.
3. Set SGLANG_USE_PICKLE_IPC=false — This environment variable disables pickle-based IPC in SGLang. While the advisory specifically targets the HTTP endpoint (not the IPC path), disabling pickle wherever possible reduces the overall attack surface from the other five CVEs in this batch. Deploy within 3 days.
4. Bind SGLang to localhost or internal-only interfaces — Launch SGLang with --host 127.0.0.1 instead of --host 0.0.0.0. Use a reverse proxy for any necessary external access. This prevents direct network access to vulnerable endpoints. Deploy within 3 days.
5. Deploy runtime security monitoring on GPU nodes — Install Falco, Sysdig Secure, or CrowdStrike Falcon for Linux on SGLang hosts. Alert on unexpected child processes spawned by the Python SGLang process (e.g., sh, bash, curl, wget). This provides detection-in-depth while waiting for a vendor patch.

Run this script on each host where SGLang is deployed, or from an auditor workstation with network access to the SGLang API port. No special privileges required. Example: bash check_cve_2026_15969.sh 10.0.1.50:30000

#!/usr/bin/env bash
# check_cve_2026_15969.sh — Detect SGLang instances vulnerable to CVE-2026-15969
# Usage: bash check_cve_2026_15969.sh <host:port>
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <host:port>"
  exit 2
fi

TARGET="$1"
BASE_URL="http://${TARGET}"

# Step 1: Check if the SGLang server is reachable
if ! curl -sf --max-time 5 "${BASE_URL}/health" > /dev/null 2>&1; then
  echo "UNKNOWN — Cannot reach SGLang at ${TARGET} (health endpoint unreachable)"
  exit 2
fi

# Step 2: Check if the vulnerable endpoint exists and accepts requests
# We send an intentionally malformed (non-pickle) payload to see if the endpoint is present
HTTP_CODE=$(curl -sf --max-time 10 -o /dev/null -w '%{http_code}' \
  -X POST "${BASE_URL}/load_lora_adapter_from_tensors" \
  -H 'Content-Type: application/json' \
  -d '{"test": "probe"}' 2>/dev/null || echo "000")

if [ "$HTTP_CODE" = "000" ] || [ "$HTTP_CODE" = "404" ]; then
  echo "PATCHED — Endpoint /load_lora_adapter_from_tensors not found at ${TARGET} (HTTP ${HTTP_CODE})"
  exit 1
elif [ "$HTTP_CODE" = "405" ]; then
  echo "UNKNOWN — Endpoint exists but returned Method Not Allowed (HTTP 405). Manual review needed."
  exit 2
else
  # Endpoint exists (returned 400, 422, 500, or 200) — server accepted the route
  echo "VULNERABLE — Endpoint /load_lora_adapter_from_tensors is active at ${TARGET} (HTTP ${HTTP_CODE}). No patch exists for CVE-2026-15969. Apply compensating controls immediately."
  exit 0
fi

Sources

1. CERT/CC VU#281278 — SGLang six vulnerabilities advisory
2. Vista Net — VU#281278 coverage with CVE details
3. Orca Security — Pickle in the Pipeline: SGLang RCE research
4. Chocapikk — SGLang Pickle RCE via ZMQ Transport
5. Security Online — Poisoned Pickle: Critical Unpatched SGLang Flaws
6. OpenA2A Research — State of AI Agent Security (exposure data)
7. SGLang GitHub repository