SGLang CVE-2026-86793: unauthenticated RCE on your GPU box

If you self-host models on SGLang, you have a job today. CVE-2026-86793, published September 11, lets an unauthenticated HTTP request execute code on the host running your inference server — the box with your GPUs, your model weights, and usually a cloud credential or two. There was no patch at disclosure. The fix is configuration, and it takes an afternoon.

What actually happened

SGLang exposes /update_weights_from_tensor, an endpoint that accepts pickled tensor data. Pickle deserialization is remote code execution by design, which is why SGLang added a SafeUnpickler in v0.5.4 to fix an earlier bug, CVE-2025-10164.

The new CVE is a bypass of that guard. Per VicOne, whose researcher Reuel Magistrado found it, the allowlist matches on the prefix builtins. — permitting any builtin not explicitly blocked — while the deny list omits __import__ and getattr. Chain those two and you reach any function in any importable module without ever tripping the filter. The report's summary: an attacker can use them "as a gadget chain to reach any function in any importable module...without ever triggering the denylist." The end of the chain is os.system().

Two caveats worth stating plainly. The endpoint is only unauthenticated when no auth keys are configured, which is the default posture on a lot of internal deployments. And the version range is not settled: VicOne's report says 0.5.14 and earlier, while the CVE record lists affected versions through 0.5.18. Treat every deployment as affected until maintainers publish a fixed release. CERT/CC assigned the CVE; no CVSS score has been published.

Why an unauthenticated inference RCE matters for your business

Self-hosting was supposed to be the safe choice. You kept the data in your VPC, you avoided the token bill, you owned the stack. That reasoning is still right — and it means the security of the serving layer is now yours too, and most teams have not treated an inference server like the internet-facing service it often is.

Think about what that host holds. Model weights you may have paid to fine-tune. The instance role, which in a default Terraform module usually reaches more S3 than anyone intended. Whatever sits in the request logs. An RCE there is not a model problem, it is a lateral movement problem.

Do three things. Turn on SGLang's auth keys — this alone closes the unauthenticated path. Put the serving port behind a security group or service mesh policy that admits only your application tier, never 0.0.0.0/0 and never the office VPN by default. Then check egress: an inference box needs to reach your object store and your telemetry endpoint, and very little else, so a restrictive egress rule turns a successful RCE into a much worse day for the attacker. Pin the SGLang version in your image build and subscribe to the repo's advisories, because the patch will land and you want to notice.

Sources: VicOne security research, CVE-2026-86793 record.