CVE-2026-14890: Critical severity SGLang vulnerability
SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict the feature by disabling the expert-parallel backup subsystem that exposes an unauthenticated ZeroMQ PULL socket over a routable network interface; ensure the reachable service does not accept unauthenticated inbound messages that could trigger unsafe deserialization (malicious pickle).
SGLang expert-parallel backup subsystem (ZeroMQ PULL socket) Authentication/deserialization safeguards (not present) = Enable authentication and prevent unsafe deserialization - Compensating control
Ensure the service/ZeroMQ endpoint that receives backup subsystem messages is not reachable from untrusted networks (e.g., place behind network ACL/firewall rules so only trusted hosts can reach it).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14890?
CVE-2026-14890 has a critical severity rating of 9.1.
What vulnerabilities are associated with CVE-2026-14890?
CVE-2026-14890 allows for unauthenticated remote code execution due to lack of authentication and deserialization safeguards.
How do I fix CVE-2026-14890?
To fix CVE-2026-14890, implement authentication and proper input validation on the ZeroMQ PULL socket.
Who is affected by CVE-2026-14890?
SGLang users operating the expert-parallel backup subsystem are affected by CVE-2026-14890.
When was CVE-2026-14890 published?
CVE-2026-14890 was published on July 16, 2026.