SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.
References
| Link | Resource |
|---|---|
| https://github.com/sgl-project/sglang/security/advisories/GHSA-cpqq-22v3-2wfm | Broken Link |
| https://thoughts.apoorvdayal.com/posts/sglang-disclosures/ | Third Party Advisory Mitigation |
| https://thoughts.apoorvdayal.com/posts/sglang-disclosures/ | Third Party Advisory Mitigation |
Configurations
History
04 Aug 2026, 20:40
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Lmsys
Lmsys sglang |
|
| References | () https://github.com/sgl-project/sglang/security/advisories/GHSA-cpqq-22v3-2wfm - Broken Link | |
| References | () https://thoughts.apoorvdayal.com/posts/sglang-disclosures/ - Third Party Advisory, Mitigation | |
| CPE | cpe:2.3:a:lmsys:sglang:*:*:*:*:*:*:*:* |
31 Jul 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://thoughts.apoorvdayal.com/posts/sglang-disclosures/ - | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-306 |
30 Jul 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-30 19:17
Updated : 2026-08-04 20:40
NVD link : CVE-2026-15978
Mitre link : CVE-2026-15978
CVE.ORG link : CVE-2026-15978
JSON object : View
Products Affected
lmsys
- sglang
CWE
CWE-306
Missing Authentication for Critical Function