CVE-2026-15978

EUVD-2026-51266
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 36.59%
Affected Products (NVD)
VendorProductVersion
lmsyssglang
𝑥
≤ 0.5.15
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/sgl-project/sglang/security/advisories/GHSA-cpqq-22v3-2wfm
https://thoughts.apoorvdayal.com/posts/sglang-disclosures/
https://thoughts.apoorvdayal.com/posts/sglang-disclosures/