CVE-2026-15974

概要

参考情報

• sgl-project/sglang security advisory · Broken Link
• thoughts.apoorvdayal.com/posts/sglang-disclosures · Third Party Advisory

sglang のその他の脆弱性

• CVE-2026-15978高 7.5SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a …
• CVE-2026-15977高 7.5SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when…
• CVE-2026-15976緊急 9.8SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_wei…
• CVE-2026-15971緊急 9.8SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is…
• CVE-2026-15969緊急 9.8SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitr…