CVE-2026-111391: SGLang Code Injection RCE Vulnerability

CVE-2026-111391 Overview

CVE-2026-111391 is a code injection vulnerability [CWE-95] in SGLang versions 0.5.10 through 0.5.22. The flaw resides in the _evaluate_filter() function inside the debug dumper component. Remote attackers can escape the eval() sandbox by abusing re.search.__globals__ to reach arbitrary Python builtins. Exploitation requires sending a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is configured. The injected code executes inside the scheduler process on the next forward pass, giving the attacker code execution in the context of the SGLang inference server.

Critical Impact
Unauthenticated remote attackers can achieve arbitrary Python code execution within the SGLang scheduler process, compromising model-serving infrastructure and any data it processes.

Affected Products

SGLang 0.5.10
SGLang versions between 0.5.10 and 0.5.22
SGLang 0.5.22

Discovery Timeline

2026-10-16 - CVE-2026-111391 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-111391

Vulnerability Analysis

SGLang ships a debug dumper utility that lets operators configure filters controlling which tensors to dump during inference. The /dumper/configure endpoint accepts a user-supplied filter expression and passes it to _evaluate_filter(), which evaluates the expression with Python's eval(). The developers attempted to sandbox evaluation by restricting globals, but the sandbox does not block attribute traversal on legitimate module objects exposed to the filter context. An attacker who reaches any object with a __globals__ attribute, such as re.search, can walk the attribute chain to __builtins__ and invoke __import__, exec, or eval directly. Because the endpoint has no authentication, any network-reachable client can submit a payload. The filter is stored and later invoked by the scheduler, so code runs on the next forward pass within the scheduler process context.

Root Cause

The root cause is unsafe use of eval() on attacker-controlled input combined with an incomplete sandbox. The restricted globals leave reachable objects whose __globals__ dictionaries expose the full Python builtin namespace, defeating the restriction. Compounding this, the /dumper/configure endpoint lacks authentication or network access controls when DUMPER_SERVER_PORT is set. See the GitHub sglang Debug Dumper Code for the vulnerable implementation.

Attack Vector

The attacker sends an HTTP request to the /dumper/configure endpoint on the exposed DUMPER_SERVER_PORT. The request contains a filter expression that references re.search.__globals__['__builtins__'] and chains to __import__('os').system(...) or an equivalent primitive. SGLang stores the filter and executes it the next time the scheduler performs a forward pass, resulting in arbitrary code execution. Full technical write-up is available in the VulnCheck Advisory for sglang.

Detection Methods for CVE-2026-111391

Indicators of Compromise

HTTP POST requests to /dumper/configure from untrusted sources, especially containing substrings such as __globals__, __builtins__, __import__, or re.search.
Unexpected child processes spawned by the SGLang scheduler process (for example, /bin/sh, python, or outbound network tools).
New or modified files in the dumper output directory immediately following a /dumper/configure request.
SGLang processes initiating outbound network connections not associated with model serving traffic.

Detection Strategies

Inspect reverse-proxy and load-balancer logs for requests targeting the /dumper/configure path on the port defined by DUMPER_SERVER_PORT.
Alert on Python eval() sandbox escape patterns in request bodies using WAF or IDS signatures that match dunder attribute chains.
Monitor the SGLang scheduler process tree for anomalous child processes using endpoint telemetry.

Monitoring Recommendations

Enable process-execution and network-connection telemetry on hosts running SGLang inference workloads.
Capture full HTTP request bodies for the dumper port and retain them for retrospective hunting.
Baseline normal scheduler process behavior and alert on deviations such as new outbound connections or shell execution.

How to Mitigate CVE-2026-111391

Immediate Actions Required

Unset DUMPER_SERVER_PORT on all production SGLang deployments to disable the vulnerable endpoint.
Block external and lateral network access to the dumper port using host firewalls, Kubernetes network policies, or security groups.
Audit running SGLang instances for prior requests to /dumper/configure and investigate any matches as potential compromise.
Rotate credentials and secrets accessible to the SGLang scheduler process if indicators of exploitation are found.

Patch Information

At the time of publication, the issue is tracked in GitHub sglang Issue #44188 and affects SGLang releases 0.5.10 through 0.5.22. Upgrade to a release that remediates _evaluate_filter() once available from the SGLang project, and confirm the fix removes eval() or enforces a strict allowlist on filter expressions.

Workarounds

Do not set DUMPER_SERVER_PORT; the dumper HTTP server is disabled by default when the variable is unset.
If the dumper is required for debugging, bind it only to 127.0.0.1 and tunnel access through an authenticated jump host.
Place SGLang behind a reverse proxy that strips or rejects requests to /dumper/configure.
Run SGLang as a low-privilege user inside a container with a read-only filesystem and egress network restrictions to limit post-exploitation impact.

bash

# Configuration example: disable the dumper endpoint and block the port
unset DUMPER_SERVER_PORT

# Example iptables rule to block external access to a dumper port (e.g. 30000)
iptables -A INPUT -p tcp --dport 30000 ! -s 127.0.0.1 -j DROP