External risk intelligence

SGLang Code Injection via Debug Dumper Filter.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-111391

The vulnerability exists in a specific debug/dumper endpoint of the SGLang server. While the endpoint is unauthenticated and network-reachable, it typically requires a specific optional configuration (DUMPER_SERVER_PORT) to be enabled. It is not a standard public-facing web service by design in common deployments, but could be exposed if misconfigured or left enabled in an internet-accessible environment.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A code injection vulnerability has been identified in the SGLang server software, specifically within its debug dumper functionality. This issue could allow unauthorized remote attackers to execute arbitrary Python code, posing a potential risk if the affected component is exposed. The main concern is to confirm if this specific functionality is in use within our environment.

Attackers can run code on our systems.
This could affect server security if enabled.
Confirm if debug features are active.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted filter expression to an unauthenticated configuration endpoint. This allows them to bypass security measures and execute arbitrary Python code on the server, potentially leading to a compromise of the scheduler process.

No authentication required for the endpoint.
Malicious filter expression sent to configure endpoint.
Arbitrary Python code execution.

Live Threat

Current exploitation, exposure, and threat context

A code injection vulnerability exists in the SGLang debug dumper when a specific configuration is enabled, potentially allowing remote attackers to execute arbitrary Python code on the scheduler process during its next forward pass. This could occur if an attacker sends a specially crafted filter expression to an unauthenticated endpoint.

Scheduler process code.
Crafted filter expression sent.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application owner or platform team is likely responsible for addressing this code injection vulnerability within the SGLang scheduler process. The first practical step is to identify all instances of SGLang, confirm if the `DUMPER_SERVER_PORT` is configured and exposed externally, and then assess business criticality to prioritize remediation.

Application or platform teams own the issue.
Verify `DUMPER_SERVER_PORT` configuration and exposure.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SGLang?

SGLang is a software framework designed to optimize large language model serving and control flow. It provides specialized infrastructure for managing complex LLM tasks and includes debugging tools meant for developers to monitor system performance. This vulnerability resides specifically in a diagnostic component intended for internal state inspection rather than a core public-facing API.

What does CVE-2026-111391 mean by code injection?

This vulnerability, classified as Improper Neutralization of Directives in Dynamically Evaluated Code (CWE-95), happens when the application takes untrusted input and processes it as code. Because the software uses an eval() function to filter data, a specially crafted input can break out of the intended sandbox to execute unauthorized Python commands directly within the scheduler process.

Does any input trigger this flaw?

No. The vulnerability is only reachable when the specific DUMPER_SERVER_PORT configuration is actively enabled. If the debug dumper feature is not turned on or the port is not configured, the vulnerable code path remains inactive. An attacker must send a specifically crafted filter expression to this precise, unauthenticated endpoint to trigger the sandbox escape.

Is my SGLang installation at risk?

Halo Surface Signal indicates the risk is possible rather than guaranteed. Your exposure depends on whether the debug dumper is active and network-accessible. While the endpoint lacks authentication, it is not a standard feature intended for public exposure. You are at higher risk if your server is reachable over the internet with the debug port enabled, rather than restricted to a private, internal network.

How should I respond to this threat?

Start by auditing your SGLang deployments to verify if the DUMPER_SERVER_PORT environment variable is set. If this diagnostic feature is unnecessary for production operations, disabling it is the primary way to remove the attack vector. If you must use these debug capabilities, ensure the service is isolated from external network access and restricted to trusted internal administrative environments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.