CVE-2026-112268: sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes
Published Oct 19, 2026
·Updated
sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination.
Affected Software
1 affected component
sglang-router<=0.3.2
Event History
Oct 19, 2026
CVE Published
via MITRE·01:55 PM
Data Sourced
via MITRE·01:55 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which users or systems can reach the affected management functionality?
Any holder of the data-plane API key can access the /ha/* mesh HA management routes. Control-plane Admin role checks are skipped for those endpoints.
2
What could an attacker do with this access?
They can read cluster topology, write gossiped configuration, change global rate limits, and invoke POST /ha/shutdown. The shutdown action can silently dissolve HA coordination.