CVE-2026-92972: SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint
SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to attacker-controlled endpoints, causing denial of service or disclosure of KV transfer metadata including session identifiers and tensor-parallel topology parameters.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SGLang deployments through 0.5.19 that use prefill/decode disaggregation mode are affected if the prefill bootstrap service's PUT /route endpoint is reachable by an attacker. The issue concerns the routing table used for KV transfer between prefill and decode workers.
What does an attacker need to exploit it?
An attacker does not need authentication, user interaction, or prior privileges. They need network access to the prefill bootstrap service and the ability to send a PUT request to /route with chosen rank_ip and rank_port values.
What can happen if exploitation succeeds?
An attacker can redirect decode workers to attacker-controlled endpoints by poisoning KV transfer routing entries. This can cause denial of service and may disclose KV transfer metadata, including session identifiers and tensor-parallel topology parameters.
What can be done while patching is unavailable?
Restrict network access to the prefill bootstrap service so untrusted systems cannot reach its PUT /route endpoint. In particular, limit access to the network paths used only by authorized prefill and decode components.