CVE-2026-112268 in sglang-router
Summary
by MITRE • 10/19/2026
sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in sglang-router, also known as sgl-model-gateway, versions through 0.3.2 represents a critical authorization bypass within the application's high availability management subsystem. This flaw stems from an inconsistent implementation of access control policies across different API endpoints. Specifically, while standard data-plane operations are correctly secured by requiring valid authentication tokens and appropriate role-based permissions, the administrative routes under the /ha/* path fail to enforce equivalent security checks. The root cause lies in the omission of control-plane Admin role verification for these specific management interfaces. Consequently, any entity possessing a valid data-plane API key, which is typically intended for lower-privilege operational tasks such as model inference requests, can inadvertently or maliciously escalate its privileges by targeting these unprotected administrative endpoints. This architectural oversight creates a significant gap in the defense-in-depth strategy of the gateway, allowing unauthorized entities to interact with sensitive cluster management functions without proper authorization validation.
The technical implications of this vulnerability are severe due to the nature of the exposed functionality. The /ha/* endpoints provide direct access to high availability coordination mechanisms, which are essential for maintaining service continuity and performance in distributed systems. An attacker leveraging this flaw can read the current cluster topology, thereby gaining insight into the internal network structure, node distribution, and health status of various components within the mesh. This information disclosure facilitates further reconnaissance and planning for more targeted attacks against specific nodes or services. Furthermore, the ability to write gossiped configuration data allows an adversary to manipulate how nodes communicate and synchronize state with one another. By altering these configurations, an attacker can induce inconsistencies in cluster behavior, potentially leading to split-brain scenarios where multiple leaders claim authority over different parts of the cluster, causing service degradation or complete outage.
Beyond information disclosure and configuration manipulation, the vulnerability permits active disruption of services through rate limit modification and forced shutdowns. Attackers can change global rate limits, effectively throttling legitimate traffic or allowing excessive abuse by flooding the system with requests, leading to denial-of-service conditions for genuine users. More critically, the ability to call POST /ha/shutdown enables an attacker to silently dissolve high availability coordination. This action disrupts the heartbeat mechanisms and leader election processes that keep the cluster synchronized. The result is a loss of redundancy and failover capabilities, leaving individual nodes vulnerable to failure without automatic recovery. In production environments relying on sglang-router for serving large language models, this can lead to cascading failures, increased latency, or total service unavailability as the system loses its ability to manage node health and distribute load effectively among available instances.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting issues where authorization checks are inconsistently applied across different parts of an application interface. It also relates to CWE-613 Insufficient Session Expiration if the data-plane key remains valid and is exploited over time without rotation. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1078 Valid Accounts, as it involves using legitimate credentials for unauthorized purposes, and potentially T1496 Resource Hijacking or T1529 System Shutdown/Reboot if the shutdown endpoint is abused to disrupt operations. The scenario exemplifies a common pitfall in microservices architecture where management planes are not isolated from data planes with sufficient rigor, allowing lateral movement and privilege escalation through misconfigured API gateways.
Mitigation strategies must prioritize immediate remediation of the access control logic within the sglang-router codebase. Developers should enforce strict role-based access control on all /ha/* endpoints, ensuring that only users or services explicitly designated as Control-Plane Admins can invoke these functions. This requires validating not just the presence of an API key but also verifying the specific permissions associated with that key against a predefined policy for administrative actions. Additionally, implementing network-level segmentation is crucial; management interfaces should be restricted to internal networks accessible only by trusted infrastructure components rather than being exposed through general-purpose API gateways. Regular security audits and static analysis tools configured to detect inconsistent authorization patterns can help prevent similar issues in future releases. For organizations currently running affected versions, restricting the scope of data-plane keys to exclude administrative privileges or rotating these keys immediately upon detection is a necessary interim measure until an official patch is deployed.