CVE-2026-112267: SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker
SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstraphost and bootstrapport fields. Attackers sending crafted requests to the Decode worker's /generate endpoint can probe internal hosts and ports and block the shared scheduler loop, delaying other inference requests.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Exposure is limited to SGLang deployments using prefill/decode disaggregation mode where an attacker can send requests to the Decode worker's /generate endpoint.
Does an attacker need credentials or user interaction?
No. The issue is exploitable by an unauthenticated attacker using crafted bootstrap_host and bootstrap_port values in a request to the Decode worker.
What can exploitation do beyond internal network probing?
An attacker can cause outbound requests to internal hosts and ports, and can block the shared scheduler loop. Blocking that loop can delay inference requests from other users.
What versions are identified as affected?
The affected range is SGLang through version 0.5.22. The provided data does not identify a fixed version.