CVE-2026-105245: sglang Cleartext Information Disclosure Flaw

CVE-2026-105245 Overview

CVE-2026-105245 affects sgl-project sglang through version 0.5.21. The vulnerability resides in the server_info function of python/sglang/srt/entrypoints/http_server.py. Manipulation of the api_key argument leads to cleartext transmission of sensitive information through the HTTP endpoint. The flaw is remotely reachable but requires high attack complexity, and the issue is classified under [CWE-310] Cryptographic Issues. A pull request addressing the issue has been published and awaits acceptance by the maintainers.

Critical Impact
An attacker positioned to observe network traffic or inspect server responses can harvest the sglang api_key because it is exposed in cleartext through the server_info endpoint.

Affected Products

sgl-project sglang versions up to and including 0.5.21
Component: HTTP Endpoint (python/sglang/srt/entrypoints/http_server.py)
Function: server_info

Discovery Timeline

2026-10-05 - CVE-2026-105245 published to the National Vulnerability Database (NVD)
2026-10-07 - Last updated in the NVD database

Technical Details for CVE-2026-105245

Vulnerability Analysis

The server_info HTTP endpoint in sglang returns server state information to callers. The implementation includes the api_key value in the response payload without masking, redaction, or encryption at the application layer. Any client able to invoke the endpoint can retrieve the key in plaintext. Because the key authorizes requests to the inference service, its disclosure undermines the primary access control for the deployment.

The issue is categorized under [CWE-310] (Cryptographic Issues), specifically concerning cleartext transmission of sensitive information. The attack vector is network-based but assessed as high complexity, reflecting that an adversary must either reach the endpoint directly or observe its traffic on an unencrypted channel.

Root Cause

The root cause is improper handling of a secret within the server_info response. The api_key value, which should be treated as a confidential credential, is serialized into the HTTP response produced by server_info in python/sglang/srt/entrypoints/http_server.py. There is no filtering of sensitive configuration fields before the server state is returned to the caller.

Attack Vector

An attacker who can reach the sglang HTTP interface, or who can observe traffic to and from it on a non-TLS channel, queries the server_info endpoint and parses the returned document for the api_key field. Because the endpoint is reachable over the network and the response is cleartext, no authenticated session or local access is required for retrieval when the endpoint is exposed. The disclosed key can then be reused to authenticate inference requests. Technical details are tracked in GitHub Issue #30166 and remediation is proposed in GitHub Pull Request #30343.

Detection Methods for CVE-2026-105245

Indicators of Compromise

Unexpected HTTP GET requests to the /server_info (or equivalent) route on sglang instances, especially from external or non-operator source addresses.
Reuse of an api_key from source IPs that do not match the expected operator or application tier.
Access logs showing server_info responses larger than baseline, suggesting the full configuration payload was returned.

Detection Strategies

Inspect sglang access logs for calls to the server_info endpoint and correlate the caller against an allowlist of administrative hosts.
Deploy an HTTP response inspection rule in a reverse proxy or WAF that flags responses from sglang containing the string api_key outside administrative networks.
Monitor for sglang API traffic transiting unencrypted HTTP, which exposes the key to passive network observers.

Monitoring Recommendations

Centralize sglang HTTP access and application logs in a SIEM and alert on first-seen source addresses invoking server_info.
Track outbound usage of the sglang api_key and compare against expected client fingerprints such as user agent, IP, and request cadence.
Baseline normal traffic to the server_info endpoint and alert on volume spikes or scanning patterns.

How to Mitigate CVE-2026-105245

Immediate Actions Required

Restrict network exposure of the sglang HTTP server to trusted administrative segments using firewall rules or a reverse proxy ACL.
Rotate any api_key values that may have been exposed through the server_info endpoint, especially on internet-reachable deployments.
Terminate all client traffic over TLS to prevent passive capture of the api_key from unencrypted responses.

Patch Information

At the time of publication, the fix is proposed in GitHub Pull Request #30343 and awaits acceptance by the sgl-project maintainers. Track the upstream sglang repository for the released version and upgrade once a build containing the merged fix is published. Additional vulnerability metadata is available in the VulDB entry for CVE-2026-105245.

Workarounds

Block or disable the server_info route at a reverse proxy until the upstream patch is merged and deployed.
Place sglang behind an authenticating proxy so unauthenticated callers cannot reach server_info.
Avoid configuring an api_key on exposed deployments where the key would be returned by server_info; isolate such instances on private networks.

bash

# Example NGINX snippet to block the server_info endpoint
location = /server_info {
    deny all;
    return 403;
}