CVE-2026-15976: 
SGLang vulnerability analysis and mitigation

CVE-2026-15976 is a critical Remote Code Execution (RCE) vulnerability in SGLang, an LLM serving framework, affecting all versions up to and including v0.5.15. The flaw resides in the /update_weights_from_disk endpoint, where torch.load(..., weights_only=False) fallback enables unsafe pickle deserialization of .bin model weight files loaded from HuggingFace repositories. The vulnerability was published on July 30, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory).

The root cause is classified as CWE-502 (Deserialization of Untrusted Data). When SGLang's /update_weights_from_disk endpoint processes model weight files, it invokes torch.load() with weights_only=False, which falls back to Python's pickle deserialization mechanism for .bin files. Because pickle can execute arbitrary Python code during deserialization, a malicious .bin file crafted by an attacker will trigger code execution on the server at load time. No authentication, privileges, or user interaction are required to trigger this path, making it fully remotely exploitable over the network (GitHub Advisory, CERT/CC).

Successful exploitation grants an unauthenticated remote attacker full code execution on the SGLang server, resulting in high confidentiality, integrity, and availability impact. An attacker could exfiltrate sensitive data (including model weights, API keys, or training data), modify or destroy server resources, install persistent backdoors, or pivot laterally within the hosting environment. The NVD SSVC assessment classifies the technical impact as "total," reflecting complete system compromise (GitHub Advisory).

The NVD SSVC assessment marks this vulnerability as having a proof-of-concept (PoC) available and as "automatable," meaning exploitation can be scripted without manual interaction. The EPSS score is approximately 0.26–0.33%, indicating a relatively low but non-negligible probability of exploitation in the near term. As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation or threat actor attribution, and the vulnerability has not been added to the CISA KEV catalog (GitHub Advisory, CERT/CC).

1. Reconnaissance: Identify internet-accessible SGLang server instances (versions ≤ 0.5.15) using network scanning tools such as Shodan or Censys, targeting the default SGLang API port and the /update_weights_from_disk endpoint.
2. Craft malicious .bin file: Create a Python pickle payload embedded in a .bin file that executes arbitrary commands (e.g., a reverse shell) upon deserialization. This can be done using Python's pickle module with a custom __reduce__ method.
3. Host the malicious file: Upload the crafted .bin file to an attacker-controlled HuggingFace repository or a web server accessible to the target SGLang instance.
4. Trigger weight loading: Send an HTTP request to the /update_weights_from_disk endpoint on the target server, specifying the path or URL to the malicious .bin file as the model weights source.
5. Achieve RCE: The SGLang server calls torch.load(..., weights_only=False) on the malicious file, triggering pickle deserialization and executing the attacker's payload with the privileges of the SGLang process (GitHub Advisory).

• Network: Unexpected outbound connections from the SGLang server to external IPs or HuggingFace repositories not in normal operational use; reverse shell connections originating from the SGLang process.
• Logs: HTTP POST or GET requests to /update_weights_from_disk with unusual or external file paths/URLs in request parameters; errors or tracebacks in SGLang logs related to torch.load or pickle deserialization.
• File System: Unexpected .bin files downloaded to the SGLang working directory from external sources; new scripts, cron jobs, or binaries created by the SGLang process user.
• Process: Unusual child processes spawned by the SGLang Python process (e.g., bash, sh, curl, wget, python) that are not part of normal model serving operations.

Users should update SGLang to a version beyond v0.5.15 that enforces weights_only=True in torch.load() calls or implements a safe weight loading mechanism. As an immediate workaround, restrict network access to the /update_weights_from_disk endpoint so it is only reachable by trusted internal sources, and validate the integrity and provenance of all model weight files before loading. Additionally, avoid loading .bin files from untrusted or public HuggingFace repositories on production servers (GitHub Advisory, CERT/CC).

The vulnerability was covered in The Hacker News' weekly recap (August 2026) under the theme of "rogue AI models," highlighting the broader risk of malicious model weights in the AI/ML supply chain (The Hacker News). Security researcher Apoorv Dayal published a technical disclosure blog post detailing the SGLang vulnerabilities (Researcher Blog). CERT/CC issued a vulnerability note, and INCIBE-CERT published an early warning alert, reflecting institutional recognition of the severity (CERT/CC).