CVE-2026-15978 in SGLang
Summary
by MITRE • 07/30/2026
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability exists within the SGLang framework where the absence of API key configuration creates a critical security gap allowing unauthorized remote access to model weights. The flaw stems from the application's design to expose two specific endpoints when authentication is disabled, creating an attack surface that enables malicious actors to exploit distributed computing protocols for data exfiltration purposes.
The technical implementation of this vulnerability leverages NCCL (NVIDIA Collective Communications Library) which is designed for multi-GPU and multi-node communication in deep learning frameworks. When SGLang operates without proper API key enforcement, these endpoints become accessible to any remote attacker who can initiate distributed weight broadcasting operations. The NCCL protocol typically handles collective communication patterns such as all-reduce, broadcast, and gather operations that are essential for model training across distributed systems. However, in this insecure configuration, attackers can manipulate these same protocols to perform unauthorized data transfer operations.
The operational impact of this vulnerability is severe and far-reaching within the machine learning ecosystem. An attacker who successfully exploits this weakness gains complete access to all model weights stored within the SGLang environment, potentially compromising sensitive intellectual property, proprietary algorithms, and confidential training data. This represents a critical data exfiltration vector that could affect organizations using SGLang for deploying large language models or other AI systems where model weights represent significant business value and competitive advantage.
This vulnerability aligns with CWE-284 (Improper Access Control) and CWE-310 (Cryptographic Issues), as it demonstrates inadequate authorization mechanisms combined with exposure of sensitive data through network endpoints. From an ATT&CK framework perspective, this maps to T1046 (Network Service Scanning) followed by T1567 (Exfiltration Over Web Service) where the attacker initially discovers accessible endpoints and then leverages them for data extraction. The attack chain typically involves reconnaissance to identify the vulnerable SGLang instance, followed by exploitation of the NCCL-based endpoints to initiate weight broadcasting operations that ultimately result in model weight disclosure.
Organizations should implement mandatory API key enforcement across all SGLang deployments regardless of environment or use case. The recommended mitigation strategy includes configuring robust authentication mechanisms, implementing network segmentation to restrict access to sensitive endpoints, and deploying monitoring solutions to detect unauthorized access attempts. Additionally, regular security assessments should verify that no unauthenticated endpoints remain accessible within the system architecture, ensuring that distributed computing protocols like NCCL are properly secured and restricted to authorized users only.
The vulnerability demonstrates how distributed computing frameworks can introduce security risks when proper access controls are not implemented, making it essential for developers and administrators to consider security implications during system configuration. Regular updates and patch management processes should be established to address similar issues in related components, as this flaw represents a systemic security concern that may affect other frameworks implementing similar distributed communication patterns without adequate authentication mechanisms.