SGLang RCE still unpatched — 4th inference-server CVE in a month
The bug needs no auth and there's no patch — part of a wave making self-hosted model servers a live attack surface. Plus how to lock yours down, and SWE-2.
Copy markdown
No auth, no patch: SGLang's newest RCE
CVE-2026-86793 lets anyone who can reach a SGLang server's /update_weights_from_tensor endpoint run code on the box: a SafeUnpickler bypass chains __import__ and getattr down to os.system. It affects versions <= 0.5.18, fires whenever no API key is configured, and had no vendor patch at its Sept 11 disclosure — so any exposed instance is a live target right now.
Four critical inference-stack CVEs in four weeks
SGLang is only the latest. The same month brought Ollama's DNS-rebinding flaw (CVE-2026-65105, CVSS 8.1, Aug 25), a DeepSeek Harness sandbox escape (CVE-2026-82533, 9.4, Sept 8), and unauthenticated RCE in IBM Langflow via unsanitized eval() during graph construction (CVE-2026-81204, 9.8, Sept 8). If you self-host any model server, this is a recurring attack surface now, not a one-off.
The common thread: pickle and trusted Host headers
Nearly all of these trace to unsafe pickle.load() or blind trust in client-supplied Host headers on an unauthenticated local port — SGLang alone carries roughly ten CVEs, several of them pickle-RCE. Treat a model-server port like a database: set API keys, bind to localhost, firewall the admin endpoints, and prefer safetensors over pickle checkpoints wherever you can.
Elsewhere: Cognition's SWE-2 undercuts Fable by 64%
Cognition's new SWE-2, post-trained on Moonshot's open Kimi K3, matches Fable 5.1 on FrontierCode (50.0 vs 50.9) at 64% lower cost and tops Terminal-Bench 2.1 at 92.8%. The catch: no open weights and no standalone API — it runs only inside Devin (free for paid users through Oct 10), so you can use it but not build on it.