CVE-2026-15977: 
SGLang vulnerability analysis and mitigation

CVE-2026-15977 is a credential leakage vulnerability in SGLang's /server_info endpoint that exposes API keys and SSL keyfile information to unauthenticated remote attackers. It affects SGLang versions up to and including v0.5.15, developed by lmsys/sgl-project. The vulnerability was published on July 30, 2026, and has a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory). The flaw is specifically triggered when the server is configured with only the --admin-api-key option, causing sensitive credentials to be returned without authentication (GitHub Advisory).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials): the /server_info endpoint transmits authentication credentials — specifically API keys and SSL keyfile paths or contents — without requiring any authentication from the requesting client. When SGLang is launched with only the --admin-api-key flag, the endpoint fails to enforce access controls, making sensitive configuration data accessible to any network-reachable party. An attacker needs no privileges, no user interaction, and only network access to the SGLang server to exploit this flaw. A researcher blog post with additional disclosure details is available at https://thoughts.apoorvdayal.com/posts/sglang-disclosures/ (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to retrieve API keys and SSL keyfile information from the exposed /server_info endpoint, resulting in a high confidentiality impact with no integrity or availability impact. Leaked API keys could enable unauthorized access to protected AI inference services or downstream systems that rely on those credentials, potentially facilitating lateral movement or abuse of LLM inference resources. SSL keyfile exposure could further enable man-in-the-middle attacks against encrypted communications (GitHub Advisory).

The vulnerability is fully automatable and requires no authentication, privileges, or user interaction, making it trivially exploitable at scale. NVD's SSVC assessment classifies exploitation as "poc" with "automatable: yes" and "technicalImpact: partial" (GitHub Advisory). The EPSS score is approximately 0.137–0.241%, indicating a relatively low but non-negligible probability of exploitation in the near term. There is no confirmed evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing SGLang server instances (versions ≤ 0.5.15) using network scanning tools such as Shodan or Censys, searching for the default SGLang API port.
2. Probe the endpoint: Send an unauthenticated HTTP GET request to the /server_info endpoint of the target SGLang server (e.g., curl http://<target>:<port>/server_info).
3. Extract credentials: Parse the JSON response, which — when the server is configured with only --admin-api-key — will include plaintext API keys and SSL keyfile information.
4. Leverage stolen credentials: Use the extracted API keys to authenticate to the SGLang inference API or other services sharing those credentials, enabling unauthorized model queries, data exfiltration, or further lateral movement (GitHub Advisory).

• Network: Unexpected or repeated unauthenticated HTTP GET requests to the /server_info endpoint from external or unknown IP addresses; unusual outbound connections from the SGLang server following credential exposure.
• Logs: Web server or application logs showing GET requests to /server_info without authentication headers, especially from IPs not belonging to known administrative clients; high-frequency polling of the endpoint.
• Credential Abuse: API key usage from unfamiliar IP addresses or geographic locations; sudden spikes in inference API calls following exposure of the /server_info endpoint.

Apply the available security patch referenced in GitHub Advisory GHSA-vwmc-327h-6x3j, which addresses the credential leakage in the /server_info endpoint for SGLang versions beyond v0.5.15. Immediately rotate any API keys and SSL certificates that may have been exposed through the endpoint. As a workaround, restrict network access to the SGLang server's API port using firewall rules or network policies to prevent unauthenticated external access. Additionally, configure both --api-key and --admin-api-key if supported, and monitor access logs for unauthorized requests to /server_info (GitHub Advisory).

The vulnerability was covered in The Hacker News' weekly security recap for the week of August 4, 2026, which highlighted it among notable AI-related security issues (The Hacker News). Security researcher Apoorv Dayal published a detailed disclosure blog post at https://thoughts.apoorvdayal.com/posts/sglang-disclosures/, which is referenced in the official advisory. Coverage also appeared on SecurityOnline.info and other security news aggregators (GitHub Advisory).