CVE-2026-15971
Awaiting Analysis Awaiting Analysis - Queue

RCE via Sandbox Escape in SGLang with DUMPER_SERVER_PORT

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: CERT/CC

Description
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-15971
EUVD
EUVD-2026-51262

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SGLang has a remote code execution vulnerability in its dumper subsystem. If the optional dumper is enabled and the DUMPER_SERVER_PORT is configured, an attacker can bypass sandbox restrictions and execute arbitrary code during inference requests.

Impact Analysis

This vulnerability allows attackers to run malicious code on systems running SGLang with the dumper subsystem enabled. This could lead to unauthorized access, data theft, or system compromise if exploited.

Mitigation Strategies

Disable the dumper subsystem if enabled and ensure DUMPER_SERVER_PORT is not set. Review inference requests for suspicious code execution patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15971. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart