Unpatched SGLang Flaw CVE-2026-14890 Allows Unauthenticated Remote Code Execution
Do Son 
- CVE: CVE-2026-14890
- CVSS: 9.1 (Critical · CVSSv3)
- Product: SGLang
- Affected: ≤ 0.5.14
- Impact: CVE-2026-14890
- Status: No confirmed exploitation yet
- EPSS: 0.7% (30-day)
- Action: See vendor advisory
TL;DR
CERT/CC published vulnerability note VU#326070 on July 16, 2026. It details an SGLang vulnerability, CVE-2026-14890, rated CVSS 9.1. An unauthenticated attacker can run code on the host, and no patch exists.
Why it matters
SGLang serves large language models such as Qwen, DeepSeek, and Mistral. It also speaks the OpenAI API format. So it sits inside plenty of production AI stacks. A compromised inference server exposes model weights, prompts, and often GPU infrastructure.
The unpatched status makes this worse. CERT/CC states plainly that “no response was obtained from the project maintainers during coordination.” The vendor status remains unknown, and no fix has shipped.
How the attack works
The trouble starts in the expert-parallel backup subsystem. When enabled, it opens a ZeroMQ PULL socket on a routable network interface. That socket carries no authentication and no deserialization safeguards.
Anything reaching that endpoint can therefore send data straight into Python’s pickle. Pickle executes code during deserialization by design. As a result, an attacker with network access gains code execution, with no credentials required. This report shares no exploit code.
A familiar pattern
This is not SGLang’s first pickle problem. CERT/CC notes it resembles CVE-2026-7301 and CVE-2026-7304, both unauthenticated pickle RCE flaws. Those hit the multimodal scheduler and logit processor instead. Maintainers have started refactoring toward msgpack, though that work remains incomplete.
Affected configurations
CERT/CC lists no fixed version range. Instead, two conditions decide exposure. The expert-parallel backup subsystem must be running, and the service must be reachable over the network. Notably, SGLANG_USE_PICKLE_IPC still defaults to true.
Mitigation steps
Since no patch exists, network controls carry the weight. First, keep SGLang interfaces off untrusted networks entirely. Next, apply segmentation and access controls around the endpoints. Also set SGLANG_USE_PICKLE_IPC to false in environ.py. No public exploit or in-the-wild abuse has been confirmed. Given the low bar for attackers, though, this SGLang vulnerability deserves attention today.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
