SGLang RCE: an unauthenticated request runs code, no fix yet
It's the fourth critical CVE to hit self-hosted inference in four weeks — after Ollama, a DeepSeek harness, and Langflow. Here's what to disable today.
Copy markdown
Unauthenticated, and it owns the box
CVE-2026-86793 lets anyone who can reach a SGLang server's /update_weights_from_tensor endpoint run code as the serving process — no auth key needed when none is set. Every release through 0.5.18 is affected, and there's no vendor patch yet.
The 'safe' unpickler that wasn't
The endpoint's SafeUnpickler was meant to block dangerous pickle payloads, but builtins.import and builtins.getattr stayed reachable — enough to chain a REDUCE gadget into full RCE. Takeaway: a deserialization denylist is not a sandbox. Treat any network-fed pickle path as remote code execution.
Four inference CVEs in four weeks
SGLang is the newest in a run of critical bugs in self-hosted inference: Ollama's NemoClaw (CVE-2026-65105, CVSS 8.1, Aug 25), a DeepSeek agent-runtime sandbox escape (CVE-2026-82533, 9.4, Sept 8), and IBM Langflow's unauth RCE (CVE-2026-81204, 9.8, Sept 8). If any of these sits on an open port, you're a routine target now.
What to lock down tonight
Until a patch ships, disable /update_weights_from_tensor if you don't use it, require API auth keys, and bind SGLang to a specific interface — not tcp://* — behind a firewall. Never expose an inference server to an untrusted network; the same playbook covers the other three.