CVE-2026-15977

Awaiting Analysis Awaiting Analysis - Queue

Credential Leakage in SGLang via Server Info Endpoint

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: CERT/CC

Description

SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-15977

EUVD

EUVD-2026-51265

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

SGLang has a vulnerability where the /server_info endpoint exposes sensitive credentials. When only the --admin-api-key is set, this endpoint leaks API keys and SSL keyfile details, potentially allowing unauthorized access to system configurations.

Detection Guidance

Check if the /server_info endpoint is accessible without authentication by sending a GET request to the endpoint. Example: curl http://<target-ip>:<port>/server_info. If it returns API keys or SSL keyfile information, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to obtain API keys and SSL certificates, leading to unauthorized system access, data breaches, or further exploitation of the affected service.

Mitigation Strategies

Ensure the --admin-api-key is properly configured and restrict access to the /server_info endpoint. Update SGLang to the latest version if a patch is available. Monitor network traffic for unauthorized access to sensitive endpoints.

Hi! I’m here to help you understand CVE-2026-15977. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70