CVE-2026-86793

Deferred Deferred - Pending Action

SGLang Unauthenticated Pickle Deserialization Vulnerability

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: CERT/CC

Description

SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-01

AI Q&A

2026-09-11

EPSS Evaluated

2026-09-29

NVD

CVE-2026-86793

EUVD

EUVD-2026-76073

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-86793 is a vulnerability in SGLang, an open-source framework for deploying large language models. It allows unauthenticated remote code execution due to a bypass in SGLang's SafeUnpickler, which was meant to prevent deserialization attacks. The flaw exists because SafeUnpickler's allowlist includes 'builtins' and its denylist fails to block dangerous functions like __import__ and getattr. Attackers can exploit this by sending malicious pickle payloads to the unauthenticated /update_weights_from_tensor endpoint.

Detection Guidance

Check if SGLang is running with authentication disabled by inspecting HTTP requests to /update_weights_from_tensor. Monitor for unexpected pickle deserialization attempts or base64-encoded payloads in logs. Use network traffic analysis tools to detect unauthorized access to the vulnerable endpoint.

Impact Analysis

If you use SGLang without authentication enabled, an attacker could remotely execute arbitrary code on your AI servers. This could lead to data theft, server compromise, or disruption of services. The attack requires no authentication and targets a specific HTTP endpoint, making it particularly dangerous for exposed systems.

Compliance Impact

This vulnerability could lead to unauthorized code execution on AI servers, potentially exposing sensitive data processed by LLMs. For GDPR, this may result in unlawful data processing or breaches requiring notification under Articles 33-34. Under HIPAA, it risks unauthorized access to protected health information, violating safeguards in the Security Rule.

Mitigation Strategies

Enable authentication for SGLang and restrict access to the /update_weights_from_tensor endpoint. Block or filter requests containing base64-encoded pickle payloads. Update SafeUnpickler to remove 'builtins' from ALLOWED_MODULE_PREFIXES and explicitly block __import__ and getattr in DENY_CLASSES.

Hi! I’m here to help you understand CVE-2026-86793. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70