CVE-2026-15978: 
SGLang vulnerability analysis and mitigation

CVE-2026-15978 is a model weight exfiltration vulnerability in SGLang (by lmsys/sgl-project) affecting all versions up to and including v0.5.15. When no API keys are configured, SGLang exposes two unauthenticated endpoints that allow a remote attacker to trigger distributed weight broadcasting via NCCL and initiate data transfer, enabling full exfiltration of model weights. The vulnerability was published on July 30, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, CERT/CC).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function): SGLang, when deployed without API key configuration, exposes two HTTP endpoints without any authentication requirement. An attacker can remotely invoke these endpoints to trigger NCCL-based distributed weight broadcasting — a mechanism normally used for inter-GPU model weight synchronization — and redirect the resulting data transfer to an attacker-controlled destination, exfiltrating all model weights. No user interaction or prior privileges are required, and the attack complexity is low, making it fully automatable over the network (GitHub Advisory, Researcher Blog).

Successful exploitation results in complete exfiltration of all model weights hosted by the vulnerable SGLang instance, representing a severe confidentiality breach with no integrity or availability impact. For organizations deploying proprietary or fine-tuned large language models, this constitutes theft of high-value intellectual property that may represent significant investment and competitive advantage. The attack is network-accessible and requires no authentication, meaning any internet-exposed SGLang instance without API key configuration is at risk (GitHub Advisory).

A proof-of-concept is referenced as existing (NVD SSVC exploitation status: "poc"), though no confirmed in-the-wild exploitation has been observed as of the time of reporting (GitHub Advisory). The vulnerability is rated automatable by NVD SSVC analysis, meaning exploitation can be scripted without human interaction. The EPSS score is approximately 0.195% (22nd percentile), indicating a relatively low but non-negligible probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified (GitHub Advisory).

1. Reconnaissance: Identify internet-facing SGLang instances (v0.5.15 or earlier) using network scanning tools such as Shodan or Censys, looking for the default SGLang HTTP server port. Confirm the absence of API key authentication by probing endpoints for unauthenticated responses.
2. Identify vulnerable endpoints: Locate the two exposed endpoints responsible for distributed weight broadcasting. These endpoints are accessible without any authentication token when SGLang is deployed in its default or API-key-free configuration.
3. Trigger NCCL weight broadcasting: Send a crafted HTTP request to the first vulnerable endpoint to initiate the NCCL-based distributed weight broadcasting process, causing the SGLang server to begin transmitting model weights across its distributed infrastructure.
4. Redirect data transfer: Use the second exposed endpoint to trigger or redirect the data transfer, directing model weight data to an attacker-controlled server or storage location.
5. Exfiltrate model weights: Collect the transmitted model weight data at the attacker-controlled destination, achieving full exfiltration of all model weights hosted by the SGLang instance (GitHub Advisory, Researcher Blog).

• Network: Unexpected outbound connections from the SGLang server to unknown external IP addresses, particularly large data transfers consistent with model weight sizes (potentially gigabytes); unusual NCCL-related network traffic to non-cluster endpoints.
• Logs: HTTP access logs showing unauthenticated requests to the two weight broadcasting/data transfer endpoints from external or unexpected IP addresses; repeated or automated request patterns to these endpoints.
• Process: Unexpected NCCL communication processes or GPU memory read operations initiated outside of normal inference or training workflows; unusual inter-process communication patterns on the SGLang host.

The primary remediation is to upgrade SGLang to a version beyond v0.5.15 that includes the patch referenced in the GitHub Security Advisory (GitHub Advisory). As an immediate workaround, configure API keys in SGLang to restrict access to the vulnerable endpoints, preventing unauthenticated remote access. Additionally, implement network segmentation to limit remote access to SGLang instances — ideally restricting the SGLang HTTP server to trusted internal networks or VPNs only. Organizations should audit all deployed SGLang instances for API key configuration and internet exposure as a priority (GitHub Advisory, CERT/CC).

The vulnerability was covered in The Hacker News' weekly security recap for the week of August 4, 2026, which highlighted it alongside other notable AI-related security issues (The Hacker News). Security researcher Apoorv Dayal published a technical disclosure blog post detailing the SGLang vulnerabilities (Researcher Blog). SecurityOnline.info also covered the SGLang vulnerabilities, contributing to broader community awareness (SecurityOnline).