CVE-2026-15978

7.5 Élevée

Publiée le 30/07/2026 à 21:17 · Modifiée le 04/08/2026 à 22:40 · Analysée par le NVD · Source : cret@cert.org

Description

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.

Traduire en français

Produits concernés

SGLang
Lmsys sglang

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-306

Références

https://github.com/sgl-project/sglang/security/advisories/GHSA-cpqq-22v3-2wfm Broken Link
https://thoughts.apoorvdayal.com/posts/sglang-disclosures/ Third Party AdvisoryMitigation
https://thoughts.apoorvdayal.com/posts/sglang-disclosures/ Third Party AdvisoryMitigation

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories