SGLang Unauthenticated Pickle Deserialization Vulnerability

Executive Summary

CVE-2026-86793 is a vulnerability in SGLang, an open-source framework for deploying large language models. It allows unauthenticated remote code execution due to a bypass in SGLang's SafeUnpickler, which was meant to prevent deserialization attacks. The flaw exists because SafeUnpickler's allowlist includes 'builtins' and its denylist fails to block dangerous functions like __import__ and getattr. Attackers can exploit this by sending malicious pickle payloads to the unauthenticated /update_weights_from_tensor endpoint.

Useful 0 Not Useful 0

Detection Guidance

Check if SGLang is running with authentication disabled by inspecting HTTP requests to /update_weights_from_tensor. Monitor for unexpected pickle deserialization attempts or base64-encoded payloads in logs. Use network traffic analysis tools to detect unauthorized access to the vulnerable endpoint.

Useful 0 Not Useful 0

Impact Analysis

If you use SGLang without authentication enabled, an attacker could remotely execute arbitrary code on your AI servers. This could lead to data theft, server compromise, or disruption of services. The attack requires no authentication and targets a specific HTTP endpoint, making it particularly dangerous for exposed systems.

Useful 0 Not Useful 0

Mitigation Strategies

Enable authentication for SGLang and restrict access to the /update_weights_from_tensor endpoint. Block or filter requests containing base64-encoded pickle payloads. Update SafeUnpickler to remove 'builtins' from ALLOWED_MODULE_PREFIXES and explicitly block __import__ and getattr in DENY_CLASSES.

Useful 0 Not Useful 0