CVE-2026-86793: Code Injection
SGLang allows unauthenticated pickle deserialization through /updateweightsfromtensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
SGLang deployments with no authentication keys configured are exposed through the /update_weights_from_tensor endpoint. An attacker can reach the endpoint without credentials in that configuration.
What capability does an attacker need to achieve code execution?
The attacker needs to submit a malicious pickle payload to /update_weights_from_tensor. The SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, allowing code execution through pickle REDUCE.
Are default or unauthenticated configurations affected?
The described exposure specifically applies when no authentication keys are configured. The provided information does not establish whether authentication keys are enabled by default.