External risk intelligence

SGLang RCE via Incomplete SafeUnpickler Denylist

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15969

SGLang is a framework designed for large language model serving, often deployed as an API endpoint to provide inference services. Because this vulnerability exists in a function responsible for loading model adapters, it is commonly exposed as part of the internet-facing API or service interface used to interact with the model.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

SGLang, a framework for large language model serving, has a critical vulnerability that could allow an unauthenticated attacker to execute arbitrary commands on affected systems. This issue arises from an incomplete bypass of a security feature designed to protect against dangerous code execution when loading model components. The potential for remote command execution means this vulnerability could have significant implications for system security and data integrity if the affected technology is in use.

Unauthenticated command execution through model loading.
Critical flaw could impact system integrity and data.
Confirm relevance and exposure of this SGLang vulnerability.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target the SGLang `/load_lora_adapter_from_tensors` endpoint. The vulnerability stems from an incomplete denylist in the `SafeUnpickler` mechanism, which can be bypassed using specially crafted base64-encoded pickle payloads. Successful exploitation allows an attacker to execute arbitrary commands on the affected system.

No authentication required.
Bypass SafeUnpickler denylist.
Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

SGLang's handling of unauthenticated requests to load model adapters could allow for arbitrary command execution when specific conditions are met. This could impact the integrity and availability of the service.

System commands could be executed.
Malicious pickle payloads may be loaded.
Service integrity and availability are at risk.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability, application owners responsible for SGLang deployments must first identify all instances of the affected technology. Confirming whether these instances are exposed externally or are business-critical will guide prioritization. Subsequently, engaging the appropriate infrastructure or platform teams to coordinate remediation efforts based on the assessed risk is crucial.

Application owners must confirm asset inventory.
Verify external reachability and business criticality.
Plan remediation and coordinate with platform teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SGLang?

SGLang is a software framework built for serving large language models. Developers and organizations use it to host models as API endpoints, allowing applications to interact with AI services. It manages tasks like inference, which includes loading specific components or adapters to customize how the model behaves.

What does CVE-2026-15969 mean for security?

This vulnerability is classified as CWE-502, which involves the insecure deserialization of data. Specifically, SGLang uses a 'SafeUnpickler' to protect against malicious code when loading model files, but the denylist is incomplete. This flaw allows an attacker to bypass these protections using crafted payloads, leading to arbitrary command execution on the host system.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a crafted, base64-encoded pickle payload to the /load_lora_adapter_from_tensors endpoint. No authentication or credentials are required to interact with this function. It is important to note that standard model queries or typical inference requests that do not involve loading Lora adapters do not utilize this specific, vulnerable code path.

Is my SGLang deployment at risk?

According to Halo Surface Signal, this vulnerability is likely relevant if your SGLang instance is internet-facing. Because the function involved is part of the API interface used to load model adapters, any instance reachable from the public internet faces a higher risk. You should prioritize checking deployments that serve as external-facing API endpoints.

What should I do to secure my system?

Begin by auditing your infrastructure to locate every instance of SGLang running in your environment. Once identified, evaluate whether those instances are accessible from the internet or handle critical business data. Coordinate with your engineering or platform teams to prioritize these assets and apply available updates or protective measures provided by the SGLang project.

References

thoughts.apoorvdayal.com/posts/sglang-disclosures/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.