SGLang Arbitrary Code Execution Vulnerability in Unauthenticated Dumper Endpoint Affects 0.5.10-0.5.22
Attackers can run arbitrary Python code in the scheduler by exploiting a code injection flaw in unauthenticated SGLang endpoints.
Key points
- CVE-2026-111391 affects SGLang versions 0.5.10 through 0.5.22.
- The flaw allows remote code execution via the unauthenticated /dumper/configure endpoint.
- No patch has been confirmed for this vulnerability yet.
Attackers gain the ability to execute arbitrary Python code within the SGLang scheduler process. To achieve this, they need only send a crafted filter expression to the unauthenticated /dumper/configure endpoint. This action is possible when the DUMPER_SERVER_PORT environment variable is set, allowing the attacker to bypass the eval() sandbox using re.search __globals__ during the next forward pass.
How it unfolded
- The vulnerability exists in the _evaluate_filter() function within SGLang versions 0.5.10 through 0.5.22.
- Attackers target the /dumper/configure endpoint, which does not require authentication.
- A crafted filter expression escapes the sandbox, triggering code execution in the scheduler process.
Who is affected
Organizations using SGLang versions 0.5.10 through 0.5.22 are affected by this issue. The flaw is tracked as CVE-2026-111391 and is rated critical with a CVSS score of 9.2. The vulnerability is present in the sgl-project sglang software. It specifically impacts systems where the DUMPER_SERVER_PORT is configured, exposing the unauthenticated endpoint to potential exploitation by remote attackers.
The fix
No patch has been confirmed yet for this vulnerability. Users of SGLang versions 0.5.10 through 0.5.22 should monitor official channels for updates. Until a fix is available, administrators must consider the risk of remote code execution through the dumper endpoint.
What made it possible
This incident stems from improper input validation allowing sandbox escape. Attackers exploit the trust placed in the eval() function by injecting malicious context via __globals__. This technique serves the initial access or execution phase of an intrusion. Teams usually review how untrusted data flows into evaluation functions. Check whether endpoints accepting filter expressions properly sanitize inputs. Ensure that sandboxed environments cannot access global variables. Verify that unauthenticated endpoints are minimized to reduce exposure.
What to do and how to stay safe: SGLang
- Restrict network access to the /dumper/configure endpoint to prevent unauthenticated requests.
- Disable the DUMPER_SERVER_PORT if it is not required for current operations.
- Monitor scheduler processes for unexpected Python code execution or resource spikes.
- Review logs for unusual filter expressions sent to the dumper endpoint.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which SGLang versions are vulnerable to CVE-2026-111391?
SGLang versions 0.5.10 through 0.5.22 are affected by this code injection vulnerability.
Is authentication required to exploit this flaw?
No, the /dumper/configure endpoint is unauthenticated, allowing remote attackers to send crafted requests.
What is the CVSS score for this vulnerability?
The vulnerability has a CVSS score of 9.2, which is rated as critical.
