External risk intelligence

SGLang RCE Vulnerability Allows Sandbox Escape

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15971

The vulnerability involves a dumper subsystem which must be specifically enabled and configured with a custom port. While it processes inference requests which may be network-accessible, the requirement for an optional, non-default configuration makes public internet exposure less common than standard edge services.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in SGLang that, if exploited, could allow for remote code execution. This issue arises when an optional component, the dumper subsystem, is enabled and specifically configured, potentially enabling an attacker to bypass security boundaries and run unauthorized code in response to inference requests. The primary concern is to confirm whether this specific configuration is in use and assess any potential exposure.

An RCE flaw exists in SGLang's dumper.
Confirm if optional dumper subsystem is configured.
Assess potential exposure of optional, specific configurations.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted inference request over the network to a SGLang instance where the optional dumper subsystem is enabled and configured with a specific server port. This could allow the attacker to escape the sandbox and execute arbitrary code on the affected system.

Optional dumper subsystem enabled.
Crafted inference request sent.
Allows code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow for the execution of arbitrary code on systems running SGLang when its optional dumper subsystem is enabled and configured with a specific network port. This could occur when processing inference requests.

System data.
Unauthenticated network access.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SGLang RCE vulnerability, particularly when the optional dumper subsystem is enabled and configured with a specific port, requires careful assessment by application owners and potentially infrastructure or security teams. The first practical step is to confirm if this optional subsystem is deployed and accessible, identify its business criticality, and then locate the accountable owner to plan a risk-based remediation.

Identify accountable application or platform owners.
Verify if the dumper subsystem is enabled and exposed.
Plan remediation based on confirmed risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SGLang and the dumper subsystem?

SGLang is a structured generation language and runtime designed to optimize large language model inference. The dumper subsystem is an optional utility within the SGLang framework used for debugging or inspecting the state of inference requests. Because it is an elective feature rather than a core component required for basic model operation, it is typically only enabled in specific development or diagnostic environments.

What is the nature of the flaw in CVE-2026-15971?

This vulnerability is classified as Improper Neutralization of Directives in Dynamically Evaluated Code, or CWE-95. In plain terms, it means the software fails to properly filter inputs before processing them. Because of this, a specially crafted request sent to the dumper subsystem can trick the system into executing unintended commands instead of just handling data, leading to a sandbox escape.

How does an attacker trigger this vulnerability?

To trigger this, an attacker must send a specially crafted inference request to an SGLang instance where the dumper subsystem is active and bound to a network port. The vulnerability does not trigger if the dumper is disabled or if the software is running without the DUMPER_SERVER_PORT configuration. Simply running the standard SGLang framework without this specific, optional setup does not expose you to this attack.

Who is at risk according to Halo Surface Signal?

Halo Surface Signal notes that while the vulnerability is network-accessible, the risk is categorized as 'Possible' rather than universal. This is because the flaw requires a non-default, optional configuration. Organizations are only likely to be at risk if they have explicitly enabled the dumper subsystem on an instance that can be reached over the network, rather than using SGLang in a locked-down or internal-only capacity.

What should I do if I use SGLang?

Your first step is to perform an inventory check to see if the optional dumper subsystem is enabled in your environment. You should verify if the DUMPER_SERVER_PORT variable is set on any running instances. If the feature is not in use, you are not affected. If it is active, coordinate with your technical team to disable the dumper or restrict network access to that specific port until you can evaluate your update options.

References

thoughts.apoorvdayal.com/posts/sglang-disclosures/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.