CVE-2026-3060: Critical severity Lmsys Sglang vulnerability
SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.
Other sources
SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3060?
The severity of CVE-2026-3060 is critical with a CVSS score of 9.8.
How do I fix CVE-2026-3060?
To mitigate CVE-2026-3060, avoid using the disaggregation module or implement authentication before deserializing data.
What systems are affected by CVE-2026-3060?
CVE-2026-3060 affects the SGLang encoder parallel disaggregation system and related software such as pip and Lmsys Sglang.
What type of vulnerability is CVE-2026-3060?
CVE-2026-3060 is an unauthenticated remote code execution vulnerability.
What impact does CVE-2026-3060 have on data security?
CVE-2026-3060 allows attackers to execute arbitrary code, potentially compromising confidentiality, integrity, and availability of data.