CVE-2026-15977

Analyzed Analyzed - Analysis Complete

Credential Leakage in SGLang via Server Info Endpoint

Publication date: 2026-07-30

Last updated on: 2026-08-04

Assigner: CERT/CC

Description

SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-04

Generated

2026-08-20

AI Q&A

2026-07-31

EPSS Evaluated

2026-08-18

NVD

CVE-2026-15977

EUVD

EUVD-2026-51265

Affected Vendors & Products

Vendor	Product	Version / Range
lmsys	sglang	to 0.5.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

SGLang has a vulnerability where the /server_info endpoint exposes sensitive credentials. When only the --admin-api-key is set, this endpoint leaks API keys and SSL keyfile details, potentially allowing unauthorized access to system configurations.

Detection Guidance

Check if the /server_info endpoint is accessible without authentication by sending a GET request to the endpoint. Example: curl http://<target-ip>:<port>/server_info. If it returns API keys or SSL keyfile information, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to obtain API keys and SSL certificates, leading to unauthorized system access, data breaches, or further exploitation of the affected service.

Compliance Impact

The vulnerability exposes API keys and SSL keyfile information, which could lead to unauthorized access to sensitive data. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Ensure the --admin-api-key is properly configured and restrict access to the /server_info endpoint. Update SGLang to the latest version if a patch is available. Monitor network traffic for unauthorized access to sensitive endpoints.

Hi! I’m here to help you understand CVE-2026-15977. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70