CVE-2026-15971: 
SGLang vulnerability analysis and mitigation

CVE-2026-15971 is a Remote Code Execution (RCE) vulnerability in SGLang, an open-source LLM inference framework developed by lmsys/sgl-project. The vulnerability exists in the optional dumper subsystem and allows unauthenticated attackers to escape the sandbox and execute arbitrary code when the DUMPER_SERVER_PORT environment variable is set. All versions up to and including v0.5.15 are affected. It was published on July 30, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, CERT/CC).

The root cause is classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code — 'Eval Injection'), meaning SGLang's dumper subsystem fails to properly sanitize or neutralize user-controlled input before passing it to a dynamic code evaluation call (GitHub Advisory). When the DUMPER_SERVER_PORT environment variable is configured, the dumper subsystem exposes a network-accessible interface that processes inference requests without adequate input validation, enabling an attacker to inject and execute arbitrary code. Exploitation requires no authentication, no user interaction, and low attack complexity — the attacker only needs network access to the exposed dumper port. A researcher blog post at thoughts.apoorvdayal.com documents the disclosure details (GitHub Advisory). The NVD SSVC assessment classifies this vulnerability as automatable with total technical impact (GitHub Advisory).

Successful exploitation grants an unauthenticated remote attacker full code execution on the SGLang inference server, resulting in high confidentiality, integrity, and availability impact. An attacker can exfiltrate model weights, training data, or sensitive inference inputs; tamper with model outputs; or disrupt inference services entirely. Given that SGLang is commonly deployed in AI/ML infrastructure, compromise could enable lateral movement into broader cloud or on-premises environments hosting sensitive data or downstream systems (GitHub Advisory, CERT/CC).

The NVD SSVC assessment indicates a proof-of-concept (PoC) exists and that exploitation is automatable (GitHub Advisory). However, Feedly's executive summary notes no confirmed evidence of active in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.17–0.40%, placing it in the lower-to-mid percentile range for near-term exploitation probability. No threat actor attribution has been reported. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog based on available data.

1. Reconnaissance: Identify SGLang inference servers exposed to the network, particularly those running versions ≤ v0.5.15. Use tools like Shodan or Censys to search for open ports associated with DUMPER_SERVER_PORT configurations, or scan target infrastructure for SGLang service banners.
2. Confirm dumper subsystem is active: Probe the target to determine whether the DUMPER_SERVER_PORT environment variable is set and the dumper subsystem is listening. An open, responsive port on the configured dumper port confirms the attack surface.
3. Craft malicious inference request: Construct an inference request containing an eval-injectable payload targeting the dumper subsystem's input handling. The payload exploits the lack of input sanitization (CWE-95) to inject arbitrary code into the dynamic evaluation call.
4. Achieve sandbox escape and RCE: Submit the crafted request to the dumper port. The server evaluates the injected code, escaping the sandbox and executing attacker-controlled commands on the underlying host as the SGLang process user.
5. Post-exploitation: Establish persistence (e.g., reverse shell, SSH key injection), exfiltrate model data or inference inputs, or pivot to other systems on the network (GitHub Advisory, CERT/CC).

• Network: Unexpected inbound connections to the port configured via DUMPER_SERVER_PORT from external or untrusted IP addresses; outbound connections from the SGLang process to unknown external hosts (potential reverse shell or C2 traffic).
• Process: Unusual child processes spawned by the SGLang Python process (e.g., bash, sh, curl, wget, python3 with unexpected arguments); processes running under the SGLang service account performing atypical system operations.
• Logs: Inference request logs containing unusual or encoded payloads in input fields; error logs showing unexpected code evaluation exceptions or sandbox-related errors in the SGLang runtime.
• File System: New or modified files in the SGLang working directory or temp directories (e.g., dropped scripts, web shells, or binaries); unexpected cron jobs or systemd units created by the SGLang service account.
• Environment: Presence of DUMPER_SERVER_PORT set in production environment configurations where it should not be enabled.

The primary remediation is to upgrade SGLang to a version beyond v0.5.15, where the patch was made available on July 30, 2026 via GitHub Advisory GHSA-96j3-rjf9-2hxp (GitHub Advisory). As an immediate workaround, ensure the DUMPER_SERVER_PORT environment variable is not set in any production or internet-facing deployment — this disables the vulnerable dumper subsystem entirely. If the dumper subsystem must remain enabled for operational reasons, restrict network access to the dumper port using firewall rules or network segmentation to allow only trusted hosts. Audit all SGLang deployments for unintended exposure of the dumper port.

The vulnerability was covered in The Hacker News' weekly security recap for the week of August 4, 2026, which highlighted it alongside other notable AI-related security issues (The Hacker News). A Reddit thread in r/SecOpsDaily discussed the CERT/CC advisory (VU#281278) covering SGLang's six disclosed vulnerabilities, of which CVE-2026-15971 is one (Reddit). Security researcher Apoorv Dayal published a blog post detailing the SGLang disclosures (Researcher Blog). SecurityOnline.info also covered the SGLang vulnerabilities in a dedicated article (SecurityOnline).