CVE-2026-86793

SGLang, an open-source large language model inference server, is vulnerable to unauthenticated remote code execution through its /update_weights_from_tensor endpoint when no API/auth keys are configured. The endpoint deserializes attacker-supplied pickle data, and the SafeUnpickler guard intended to block dangerous operations can be bypassed because builtins.import and builtins.getattr remain resolvable, allowing arbitrary code execution via a pickle REDUCE operation. An unauthenticated attacker with network access to the server can send a crafted request and execute code in the context of the server process, fully compromising the host, model weights, and any data or prompts handled by the deployment. Any SGLang deployment running without authentication and reachable by untrusted networks is affected; version information was not specified in the advisory. There is no evidence of in-the-wild exploitation and no public proof of concept, though the flaw is straightforward for anyone familiar with pickle-based attacks to weaponize.

What to do: Immediately enable authentication by launching SGLang with API/auth keys configured so /update_weights_from_tensor is not reachable unauthenticated, and restrict server ports to trusted networks or VPN access rather than exposing them to the internet. Track the SGLang project for a patched release and upgrade once available. In the meantime, audit logs for unexpected POST requests to /update_weights_from_tensor and treat any previously internet-exposed unauthenticated instance as potentially compromised.