CVE-2026-93034: SGLang Arbitrary Code Execution Vulnerability

CVE-2026-93034 Overview

CVE-2026-93034 is an arbitrary code execution vulnerability in SGLang, a serving framework for large language models. The flaw resides in the ZeroMQ (ZMQ) message decoder, which unconditionally deserializes PickleWrapper payloads through pickle.loads() inside _maybe_unwrap_pickle. The decoder performs no type allowlisting and requires no authentication. The vulnerability persists through the msgpack path even when the SGLANG_USE_PICKLE_IPC flag is disabled. It becomes remotely exploitable when data-parallel attention is enabled with a non-loopback --dist-init-addr setting, exposing inference nodes to untrusted networks.

Critical Impact

Unauthenticated attackers reaching the ZMQ socket can execute arbitrary Python code on SGLang inference hosts, leading to full compromise of model-serving infrastructure.

Affected Products

• SGLang (sgl-project/sglang) framework for LLM inference serving
• Deployments using data-parallel attention with non-loopback --dist-init-addr
• Deployments relying on SGLANG_USE_PICKLE_IPC=0 as a mitigation (bypassed via msgpack path)

Discovery Timeline

• 2026-10-08 - CVE-2026-93034 published to the National Vulnerability Database
• 2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-93034

Vulnerability Analysis

SGLang components communicate internally over ZeroMQ sockets using a message encoding layer that supports both msgpack and pickle payloads. The receiver side invokes _maybe_unwrap_pickle, which recognizes PickleWrapper objects within an incoming message and calls pickle.loads() on their serialized contents. Because Python's pickle format allows arbitrary callables to execute during object reconstruction, any attacker who can place bytes on the socket can trigger code execution in the SGLang process context.

The environment variable SGLANG_USE_PICKLE_IPC was intended to let operators opt out of pickle-based inter-process communication. However, the msgpack decode path still inspects decoded structures for PickleWrapper markers and unwraps them through pickle, defeating the toggle. The flaw is classified under CWE-502: Deserialization of Untrusted Data.

Root Cause

The root cause is unsafe deserialization without a type allowlist, authentication, or integrity check on the ZMQ transport. _maybe_unwrap_pickle treats any PickleWrapper payload as trusted and invokes pickle.loads() directly on attacker-controlled bytes.

Attack Vector

When SGLang is launched with data-parallel attention enabled and --dist-init-addr bound to a routable interface rather than localhost, the ZMQ endpoint accepts connections from the network. An attacker crafts a message containing a PickleWrapper whose payload embeds a __reduce__ gadget. Upon receipt, the SGLang worker deserializes the payload and executes the attacker's Python code with the privileges of the inference process. See the Moody blog post on disabling pickle for an explanation of the bypass through the msgpack path.

Detection Methods for CVE-2026-93034

Indicators of Compromise

• Unexpected child processes spawned by SGLang workers, such as shells, curl, wget, or Python one-liners
• Inbound TCP connections to SGLang ZMQ ports from hosts outside the inference cluster
• SGLang processes making outbound network connections to unfamiliar hosts after receiving ZMQ traffic
• Modifications to model directories, configuration files, or SSH authorized keys on inference hosts

Detection Strategies

• Inspect SGLang startup arguments across hosts for --dist-init-addr values bound to non-loopback interfaces
• Alert on process lineage where SGLang Python workers spawn interpreters, shells, or network utilities
• Monitor for pickle module usage patterns in Python audit hooks (sys.addaudithook) tied to ZMQ receive callbacks

Monitoring Recommendations

• Capture netflow for the ports used by SGLang data-parallel communication and baseline expected peers
• Log and review environment variables of running SGLang processes, including SGLANG_USE_PICKLE_IPC
• Forward endpoint telemetry from GPU inference hosts into a central data lake for correlation across the serving fleet

How to Mitigate CVE-2026-93034

Immediate Actions Required

• Restrict --dist-init-addr to 127.0.0.1 or an isolated management interface until a patched release is deployed
• Place SGLang inference nodes behind network segmentation that blocks untrusted access to ZMQ ports
• Audit all SGLang deployments for data-parallel attention configurations exposed on routable networks
• Rotate credentials, tokens, and model artifacts stored on hosts suspected of exposure

Patch Information

No fixed version is listed in the current NVD entry. Monitor the SGLang GitHub repository for a release that removes pickle.loads() from the ZMQ decode path or enforces strict type allowlisting across both pickle and msgpack transports.

Workarounds

• Bind SGLang's distributed initialization address to loopback and tunnel inter-node traffic over authenticated transports such as SSH or mTLS
• Enforce firewall rules that permit ZMQ traffic only between known inference cluster members
• Run SGLang workers under a dedicated low-privilege account with no write access to model stores or secrets
• Treat SGLANG_USE_PICKLE_IPC=0 as insufficient on its own; combine it with network isolation

# Configuration example: restrict SGLang to loopback and least-privilege execution
python -m sglang.launch_server \
  --model-path /models/your-model \
  --dist-init-addr 127.0.0.1:29500 \
  --host 127.0.0.1

# Example iptables rule to restrict ZMQ port to cluster peers only
iptables -A INPUT -p tcp --dport 29500 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 29500 -j DROP