The CERT Coordination Center published a note on 30 July listing six separate security flaws in SGLang, the open source framework many teams use to serve large language models in production. Three of them let an attacker who can reach the server run commands on it with no credentials at all, and the National Vulnerability Database rates those three 9.8 out of 10. As of this writing there is no fix.
The note, VU#281278, was written by CERT/CC's Christopher Cullen and credits researcher Apoorv Dayal with the findings. CERT/CC lists the vendor status as unknown, stating plainly that it has not received a statement from the vendor, and says no patches were available when it published.
What the six flaws do
- CVE-2026-15969: unauthenticated code execution through the /load_lora_adapter_from_tensors endpoint, by getting past an incomplete denylist in SGLang's SafeUnpickler with a crafted base64 encoded payload.
- CVE-2026-15976: code execution while loading model weights, where a fallback to torch.load without its safe weights only mode deserializes .bin files pulled from a model repository.
- CVE-2026-15971: code execution on inference requests when the optional dumper subsystem is switched on with DUMPER_SERVER_PORT set.
- CVE-2026-15974: server side request forgery and local file access through an unsanitized image_url in /v1/chat/completions.
- CVE-2026-15977: leakage of API keys and SSL keyfile information from the /server_info endpoint.
- CVE-2026-15978: exfiltration of model weights when no API keys are configured.
NVD has published scores for the first three, all 9.8 critical. The other three carried no score at the time of writing, and CERT/CC's descriptions are the detail available on those.
Pickle keeps coming back
The two clearest code execution paths in this batch run through pickle, Python's built-in format for saving and restoring objects. Pickle executes code as it loads data, so handing it anything an attacker controls is close to running that attacker's program on purpose. It is convenient, it is everywhere in machine learning tooling, and it is why model files and adapter uploads keep turning into remote code execution.
This is the third CERT/CC note on SGLang this year. On 16 July, VU#326070 covered CVE-2026-14890, unauthenticated code execution through a ZeroMQ socket in the expert parallel subsystem, again by way of pickle, and again with no vendor statement. In March, Orca Security's Igor Stepansky reported three more, tracked as VU#665416; CERT/CC's April revision of that note points users to SGLang 0.5.10, which addressed them. The July pair has no such line.
How exposed you are
SGLang's most recent release, v0.5.16, shipped on 25 July, five days before the note, and the project has no published security advisories on its GitHub repository. CERT/CC says the maintainers are working on a refactor to msgpack to deal with the pickle problem.
There is no public evidence that any of these six are being exploited. None appears in CISA's Known Exploited Vulnerabilities catalog, and EPSS currently puts the odds of exploitation attempts in the next 30 days at around 1 percent. That is a statement about today, not a reason to relax: CERT/CC notes that most of the six need no authentication, only network access, and exposed AI infrastructure gets found fast. A botnet spent July hunting exposed AI servers for cloud credentials, and inference frameworks were among the software broken at Pwn2Own Berlin.
What you should do
Until there is a patch, the fix is network position. Keep SGLang off untrusted networks and behind segmentation, and treat any inference port reachable from the internet as the first thing to close. CERT/CC recommends setting SGLANG_USE_PICKLE_IPC to false and disabling endpoints you do not use, which covers the dumper subsystem if you never enabled it deliberately. Configure API keys, since one of the six only bites deployments that have none. And treat model weights from public repositories the way you would treat any executable download, because with a pickle fallback in the loading path that is effectively what they are.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.