{"id":"CVE-2026-111392","kind":"vulnerability","aliases":["CVE-2026-111392"],"related":[],"title":"SGLang: caller-supplied image hashes let attackers read other users' cached images","description":"SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.","summary":"SGLang through 0.5.21 uses caller-supplied mm_hashes values as the cache key for multimodal prefix caching. An attacker sending a crafted request to /generate can get another request's cached image content disclosed or corrupt the victim's responses.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-serving","multimodal","self-hosted","sglang"],"not_affected_if":["auth-required","text-only-models","trusted-callers-only"],"how_to_check":"- Check the installed SGLang version with `pip show sglang` and compare it to the fixed release listed in the sources (unknown).\n- Look for multimodal (image) inputs served by SGLang endpoints reachable from untrusted clients via /generate.","fix":"- Upgrade SGLang past `0.5.21` to the release that fixes this (exact version unknown; check the NVD entry).\n- Until patched, restrict access to the /generate endpoint to trusted callers.","status":"open","published_at":"2026-10-16T18:17:38+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:01:58+00:00","updated_at":"2026-10-25T04:01:58+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T04:01:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SGLang past `0.5.21` to the release that fixes this (exact version unknown; check the NVD entry).\n- Until patched, restrict access to the /generate endpoint to trusted callers.","reach":"internet","title":"SGLang: caller-supplied image hashes let attackers read other users' cached images","impact":"medium","summary":"SGLang through 0.5.21 uses caller-supplied mm_hashes values as the cache key for multimodal prefix caching. An attacker sending a crafted request to /generate can get another request's cached image content disclosed or corrupt the victim's responses.","category":"ai-tooling","nicknames":[],"who_cares":["sglang","llm-serving","multimodal","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads other users' image content or corrupts responses from cache","analyst_note":"Find the fixed SGLang version and whether authentication is required for /generate, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111392.","how_to_check":"- Check the installed SGLang version with `pip show sglang` and compare it to the fixed release listed in the sources (unknown).\n- Look for multimodal (image) inputs served by SGLang endpoints reachable from untrusted clients via /generate.","needs_analyst":true,"not_affected_if":["text-only-models","auth-required","trusted-callers-only"],"who_is_affected":"Teams running SGLang with multimodal (image) models where /generate is reachable by callers other than trusted internal clients, because those callers can supply the mm_hashes cache key. Deployments that are text-only or accept requests only from trusted sources are less exposed. Sources do not say which model types or configurations are required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000657,"input_tokens":3333,"output_tokens":648,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111392':16A,19A '-2026':15A,18A '/generate':56B,112C '0.5.21':33B,74C 'across':97C 'ai':21B 'ai-tool':20B 'allow':89C 'anoth':59B,115C 'attack':8A,50B,91C,99C 'cach':12A,43B,48B,62B,87C,94C 'caller':3A,36B,77C 'caller-suppli':2A,35B,76C 'content':64B,119C 'corrupt':67B,121C 'craft':53B 'cve':14A,17A 'differ':103C 'disclos':65B,114C 'entri':96C 'get':58B 'hash':6A,39B,80C,110C 'host':29B 'imag':5A,13A,63B,104C,118C 'key':44B,88C 'known':107C 'kv':95C 'let':7A 'llm':24B 'llm-serv':23B 'mm':38B,79C 'multimod':26B,46B,84C 'poison':93C 'predict':109C 'prefix':47B,86C 'prefix-cach':85C 'read':9A 'remot':90C 'request':54B,60B,98C,116C 'respons':71B,123C 'self':28B 'self-host':27B 'send':51B,101C 'serv':25B 'sglang':1A,30B,31B,72C 'suppli':4A,37B,78C 'tool':22B 'trust':75C 'use':34B 'user':11A 'valu':40B,81C 'via':111C 'victim':69B,122C","nicknames":[],"mitigations":[],"who_affected":"Teams running SGLang with multimodal (image) models where /generate is reachable by callers other than trusted internal clients, because those callers can supply the mm_hashes cache key. Deployments that are text-only or accept requests only from trusted sources are less exposed. Sources do not say which model types or configurations are required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111392","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111392","severity":null,"published_at":"2026-10-16T18:17:38+00:00","modified_at":"2026-10-16T20:17:20+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}