CVE-2026-92972 in SGLang
Summary
by MITRE • 09/17/2026
SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rank_ip and rank_port values to redirect decode workers to attacker-controlled endpoints, causing denial of service or disclosure of KV transfer metadata including session identifiers and tensor-parallel topology parameters.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in SGLang versions up to 0.5.19 represents a critical security flaw within the prefill/decode disaggregation architecture, specifically targeting the bootstrap service responsible for managing communication between different stages of large language model inference. In this architectural pattern, the prefill stage processes input tokens while the decode stage generates output tokens sequentially, requiring efficient transfer of Key-Value (KV) cache data between them. The core issue lies in an unauthenticated PUT endpoint located at /route on the prefill bootstrap service. This endpoint is designed to update or configure the KV transfer routing table, which dictates how and where decoded tensors are sent from prefill workers to decode workers. Because this administrative function lacks authentication mechanisms, any network-accessible actor can interact with it without providing credentials, effectively bypassing access controls that should restrict such configuration changes to authorized system administrators or internal services only.
The technical exploitation of this vulnerability involves an attacker sending a crafted HTTP PUT request containing arbitrary rank_ip and rank_port values within the JSON payload. By manipulating these parameters, the attacker gains control over the routing logic used by the prefill workers when transmitting KV cache data. Instead of directing traffic to legitimate decode worker endpoints as intended by the system configuration, the bootstrap service updates its internal state to point toward IP addresses and ports controlled by the adversary. This misconfiguration allows for two primary attack vectors: denial of service through disruption of inference pipelines or information disclosure via interception of sensitive metadata. The KV transfer process involves transmitting substantial amounts of tensor data along with session identifiers that track individual inference requests, as well as tensor-parallel topology parameters that reveal details about the distributed computing environment such as GPU counts and interconnect configurations.
The operational impact of this vulnerability is severe due to its potential to compromise both availability and confidentiality within cloud-native LLM deployments. When an attacker successfully poisons the routing table, legitimate decode workers may fail to receive necessary KV cache data, leading to stalled inference processes or complete service outages for end-users relying on the model API. This constitutes a denial of service condition that can be triggered remotely without prior authentication. Furthermore, if the attacker configures the route to point to their own server, they can intercept the streaming tensor-parallel metadata and session identifiers associated with active inference requests. Session tokens may allow further unauthorized access to user-specific data or model states, while topology information aids in mapping out the infrastructure for more sophisticated lateral movement attacks within private networks where SGLang is deployed.
This vulnerability aligns closely with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site which could lead to Session Fixation or other malicious activities, as well as CWE-798 Use of Hard-coded Credentials if the bootstrap service relies on default configurations that lack robust security boundaries. From an ATT&CK perspective, this falls under T1534 Internal Spearphishing for initial access implications and more specifically relates to T1071 Application Layer Protocol abuse where attackers manipulate protocol behavior to exfiltrate data or disrupt services. The exploitation also touches upon T1608 Install Residency Mechanism if the attacker uses the compromised routing table to persistently redirect traffic through their infrastructure, although in this case it is primarily a configuration manipulation rather than persistent malware installation.
Mitigation strategies must prioritize immediate remediation of access controls on administrative endpoints within distributed inference frameworks. The most effective solution involves implementing strict authentication and authorization checks for all PUT requests directed at the /route endpoint, ensuring that only verified internal services or authorized administrators can modify routing configurations. Additionally, network segmentation should be enforced to restrict direct external access to bootstrap services, placing them behind firewalls or service meshes that validate source IPs against known worker ranges. Input validation on rank_ip and rank_port fields is also essential to prevent injection of arbitrary values, though authentication remains the primary defense layer. Organizations running SGLang in production environments with prefill/decode disaggregation should immediately upgrade to patched versions where this endpoint has been secured or consider disabling remote access to bootstrap services entirely if not required for dynamic scaling operations.