CVE-2026-3060

CRITICAL

SGLang < 0.5.10 - Unauthenticated Remote Code Execution via Pickle Deserialization

Title source: llm

Description

SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.

References (4)

Core 4

Core References

Third Party Advisory

https://github.com/sgl-project/sglang/blob/main/python/sglang/srt/disaggregation/encode_receiver.py

View Writeup ZIP pw:eip

Various Sources

https://orca.security/resources/blog/sglang-llm-framework-rce-vulnerabilities/

https://github.com/sgl-project/sglang/releases/tag/v0.5.10

https://github.com/sgl-project/sglang/pull/20904

Scores

CVSS v3 9.8

EPSS 0.0116

EPSS Percentile 62.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-502

Status published

Products (3)

lmsys/sglang 0.5.5 - 0.5.9

pypi/sglang 0 - 0.5.10PyPI

SGLang/SGLang 0.5.10

Published Mar 12, 2026

Tracked Since Mar 12, 2026