CVE-2026-86793: SGLang Unauthenticated RCE Vulnerability

CVE-2026-86793 Overview

CVE-2026-86793 is an unauthenticated insecure deserialization vulnerability in SGLang, a high-performance serving framework for large language models. The /update_weights_from_tensor endpoint accepts pickle-serialized payloads without authentication when no auth keys are configured. The SafeUnpickler policy meant to restrict dangerous imports fails to block builtins.import and builtins.getattr, letting attackers pivot to arbitrary module access. Remote attackers can trigger the pickle REDUCE opcode to execute code on the AI inference server. The flaw is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact

Unauthenticated remote attackers can execute arbitrary code on SGLang inference servers, gaining full control of AI model hosts and any data or GPUs they manage.

Affected Products

• SGLang serving framework (see the SGLang GitHub repository)
• SGLang deployments running the /update_weights_from_tensor endpoint without configured auth keys
• AI inference infrastructure hosting SGLang-served large language models

Discovery Timeline

• 2026-09-11 - CVE-2026-86793 published to NVD
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-86793

Vulnerability Analysis

SGLang exposes an HTTP endpoint, /update_weights_from_tensor, that accepts serialized tensor data to hot-swap model weights during inference. The endpoint deserializes incoming payloads using Python's pickle module. When operators deploy SGLang without setting authentication keys, this endpoint is reachable by any network client that can connect to the service.

The project ships a SafeUnpickler class intended to restrict which classes and callables pickle can reconstruct. The policy denies most dangerous imports but leaves builtins.import and builtins.getattr resolvable. An attacker can craft a pickle stream that uses the REDUCE opcode to call builtins.__import__ on any module such as os or subprocess, then chain builtins.getattr to resolve arbitrary attributes. Once os.system or subprocess.Popen is reachable, the attacker executes arbitrary shell commands under the SGLang process identity.

Because SGLang typically runs with access to GPU devices, model weights, and adjacent training data, code execution on the host translates directly into model theft, weight poisoning, or lateral movement into the surrounding machine-learning platform.

Root Cause

Two compounding defects produce the vulnerability. First, the /update_weights_from_tensor endpoint has no mandatory authentication and defers to an optional auth-key mechanism. Second, the SafeUnpickler allowlist is incomplete and does not block reflective builtins that expose the full Python import surface. Deserializing attacker-controlled pickle data with a bypassable allowlist collapses to arbitrary code execution.

Attack Vector

Exploitation requires only network reachability to the SGLang HTTP interface. An attacker sends a POST request to /update_weights_from_tensor containing a pickle payload whose REDUCE opcode invokes builtins.__import__("os") followed by getattr chains that resolve to os.system or equivalent. The server deserializes the payload, the callable executes during unpickling, and the attacker's command runs on the host. No user interaction, credentials, or prior foothold are required. Further technical analysis is available in the Vicone blog on CVE-2026-86793.

Detection Methods for CVE-2026-86793

Indicators of Compromise

• HTTP POST requests to /update_weights_from_tensor from unexpected source addresses or without a preceding authenticated session.
• Payload bodies containing pickle magic bytes (\\x80\\x04 or \\x80\\x05) referencing builtins, __import__, getattr, os, or subprocess.
• SGLang worker processes spawning shells, curl, wget, or Python subprocesses that are not part of normal inference workflows.
• Outbound network connections from SGLang hosts to attacker-controlled infrastructure shortly after /update_weights_from_tensor requests.

Detection Strategies

• Enable HTTP request logging on the SGLang service and alert on any access to /update_weights_from_tensor originating outside the trusted control plane.
• Deploy endpoint or workload telemetry that flags child-process creation by the SGLang Python interpreter.
• Inspect network payloads at the reverse proxy for pickle opcodes destined for SGLang endpoints and block or quarantine matching traffic.

Monitoring Recommendations

• Baseline legitimate weight-update sources and alert on any deviation, including new client IPs or user agents.
• Monitor GPU host processes for unexpected outbound connections, cryptomining binaries, or credential-access tooling.
• Correlate SGLang access logs with authentication events to identify unauthenticated invocations of privileged endpoints.

How to Mitigate CVE-2026-86793

Immediate Actions Required

• Restrict network access to SGLang so that only trusted orchestration systems can reach the HTTP API, using firewall rules, service mesh policy, or a private network segment.
• Configure SGLang authentication keys so the /update_weights_from_tensor endpoint rejects unauthenticated requests.
• Audit SGLang hosts for signs of prior exploitation, including unexpected child processes, modified model artifacts, and anomalous outbound traffic.
• Rotate any credentials, API tokens, or model artifacts accessible from the SGLang process if compromise is suspected.

Patch Information

Monitor the SGLang GitHub repository for a fixed release that removes pickle-based deserialization from /update_weights_from_tensor or hardens the SafeUnpickler allowlist against builtins.import and builtins.getattr. Upgrade to the patched version as soon as it is published and redeploy affected inference nodes.

Workarounds

• Disable the /update_weights_from_tensor endpoint if runtime weight updates are not required by the deployment.
• Terminate SGLang traffic behind a reverse proxy that enforces authentication and blocks requests containing pickle payloads.
• Run SGLang under a dedicated low-privilege account with no shell, restricted filesystem access, and no outbound internet egress.
• Replace pickle-based weight transport with a safer serialization format such as safetensors where feasible.

# Example: restrict SGLang API to a trusted control-plane CIDR
iptables -A INPUT -p tcp --dport 30000 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 30000 -j DROP

# Launch SGLang with an auth key so /update_weights_from_tensor requires it
python -m sglang.launch_server \
  --model-path /models/llama \
  --host 127.0.0.1 \
  --port 30000 \
  --api-key "$(openssl rand -hex 32)"