SGLang Server-Side Request Forgery in Prefill/Decode Mode

Executive Summary

CVE-2026-112267 is a Server-Side Request Forgery (SSRF) vulnerability in SGLang through version 0.5.22. It occurs in prefill/decode disaggregation mode where unauthenticated attackers can manipulate client-supplied bootstrap_host and bootstrap_port fields to trigger outbound requests. By sending crafted requests to the Decode worker's /generate endpoint, attackers can probe internal hosts and ports or disrupt the shared scheduler loop, delaying other inference requests.

Useful 0 Not Useful 0

Detection Guidance

Monitor network traffic for unexpected outbound requests from SGLang decode workers, particularly to internal hosts or ports. Check logs for repeated SSRF attempts via /generate endpoint with crafted bootstrap_host and bootstrap_port fields. Use tools like tcpdump or Wireshark to inspect traffic from SGLang processes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to probe internal systems, potentially accessing sensitive data or services. It can also cause denial-of-service by delaying or blocking legitimate inference requests, increasing latency for all users. In distributed inference setups, attackers might exploit weak message validation to intercept or manipulate data in transit.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements. It may also cause service disruptions, impacting availability obligations under these regulations. Organizations using affected SGLang versions must address this to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SGLang to a patched version beyond 0.5.22. Disable direct access to Decode worker API endpoints. Implement network segmentation to restrict outbound requests from decode workers. Configure firewalls to block unauthorized internal host probing attempts.

Useful 0 Not Useful 0