CVE-2026-15974: 
SGLang vulnerability analysis and mitigation

CVE-2026-15974 is a Server-Side Request Forgery (SSRF) and local file read vulnerability in SGLang's multimodal generation endpoint /v1/chat/completions. The flaw arises from an unsanitized image_url parameter, enabling authenticated network attackers to access internal metadata, secrets, and services, as well as read local files on the server. It affects SGLang versions up to and including v0.5.15, developed by lmsys/sgl-project. Disclosed on July 30, 2026, it carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, CERT/CC).

The root cause is classified as CWE-918 (Server-Side Request Forgery), where the /v1/chat/completions endpoint accepts a user-supplied image_url parameter without adequate validation or sanitization before fetching the referenced resource (GitHub Advisory). An attacker with low-level privileges can supply a crafted URL — such as a file:// URI to read local files or an internal network address to probe internal services — and the server will fetch and return the contents. Exploitation requires network access and valid (low-privilege) credentials, but no user interaction. A technical write-up by the researcher who discovered the vulnerabilities is available at Apoorv Dayal's blog.

Successful exploitation allows an attacker to read arbitrary local files from the server (e.g., /etc/passwd, application secrets, API keys, or cloud provider metadata), access internal services not exposed to the public internet, and enumerate internal network topology. The confidentiality impact is rated High, with no integrity or availability impact (GitHub Advisory). In cloud-hosted deployments, this could expose instance metadata endpoints (e.g., AWS IMDSv1), potentially enabling privilege escalation or lateral movement to other cloud resources.

NVD's SSVC assessment classifies exploitation as requiring a proof-of-concept (PoC), though no public PoC code has been confirmed as of the time of reporting (GitHub Advisory). There is no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.137% (0.209% per GitHub Advisory), placing it in the lower percentiles for near-term exploitation likelihood. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing or internally accessible SGLang instances running version ≤ 0.5.15, particularly those exposing the /v1/chat/completions endpoint.
2. Authenticate: Obtain low-privilege API credentials or tokens if the instance requires authentication.
3. Craft malicious request: Send a POST request to /v1/chat/completions with a multimodal (image) message payload where the image_url field contains a crafted URL, such as file:///etc/passwd for local file read or http://169.254.169.254/latest/meta-data/ for AWS instance metadata.
4. Retrieve response: The server fetches the specified resource and returns its contents in the API response, exposing file contents or internal service data.
5. Escalate: Use retrieved secrets (e.g., cloud credentials, API keys) to pivot to other internal services or escalate privileges within the environment (GitHub Advisory, Apoorv Dayal's blog).

• Network: Outbound HTTP/HTTPS requests from the SGLang server process to internal IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or to file:// URIs; unusual DNS lookups for internal hostnames originating from the SGLang process.
• Logs: API access logs showing POST requests to /v1/chat/completions with image_url values containing file://, http://169.254.169.254, http://localhost, or other internal addresses; repeated requests with varying internal URLs suggesting enumeration.
• File System: No direct file system artifacts expected, but access to sensitive files (e.g., /etc/passwd, /proc/self/environ, application config files) may be reflected in OS-level file access audit logs if auditing is enabled.
• Process: The SGLang server process initiating unexpected outbound network connections to non-public IP addresses or making local file reads outside its normal working directory.

Users should update SGLang to a version beyond v0.5.15 that includes a patch for this vulnerability (GitHub Advisory, SGLang Security Advisory). As interim mitigations, operators should implement strict input validation and allowlist-based URL filtering for the image_url parameter, blocking file:// URIs and requests to internal/private IP ranges. Network-level controls such as egress filtering on the SGLang host, disabling IMDSv1 in cloud environments (enforcing IMDSv2), and applying the principle of least privilege to service credentials are also recommended.

The vulnerability was discussed on Reddit's r/SecOpsDaily community shortly after disclosure, and was included in The Hacker News weekly security recap for the week of August 2026, indicating moderate industry attention (The Hacker News). The researcher Apoorv Dayal published a detailed blog post covering multiple SGLang security disclosures simultaneously, suggesting a broader security audit of the framework (Apoorv Dayal's blog). Security news outlets including SecurityOnline.info also covered the SGLang vulnerabilities (SecurityOnline).