{"id":"CVE-2026-112267","kind":"vulnerability","aliases":["CVE-2026-112267"],"related":[],"title":"SGLang: client-supplied bootstrap fields let unauthenticated callers probe internal hosts","description":"SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port fields. Attackers sending crafted requests to the Decode worker's /generate endpoint can probe internal hosts and ports and block the shared scheduler loop, delaying other inference requests.","summary":"SGLang through 0.5.22, in prefill/decode disaggregation mode, trusts client-supplied bootstrap_host and bootstrap_port fields on the Decode worker's /generate endpoint, so it makes outbound requests to addresses the caller chooses. An unauthenticated attacker can use this to probe internal hosts and ports and to block the shared scheduler loop, delaying other inference requests.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-serving","python","self-hosted","sglang"],"not_affected_if":["auth-gateway","no-disaggregation","private-network"],"how_to_check":"- Check the installed SGLang version with `python -c \"import sglang; print(sglang.__version__)\"`; versions through `0.5.22` are in scope.\n- Check whether prefill/decode disaggregation is enabled in the deployment's launch arguments or config (unknown whether the sources name the exact flag).\n- Check whether the Decode worker's /generate endpoint is reachable from untrusted networks.","fix":"- Upgrade SGLang to a release newer than `0.5.22` (the sources do not name the fixed version: unknown).\n- Until patched, restrict network access to the Decode worker's /generate endpoint to trusted clients only.","status":"open","published_at":"2026-10-19T14:17:04+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:40:54+00:00","updated_at":"2026-10-25T03:40:54+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:40:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SGLang to a release newer than `0.5.22` (the sources do not name the fixed version: unknown).\n- Until patched, restrict network access to the Decode worker's /generate endpoint to trusted clients only.","reach":"network","title":"SGLang: client-supplied bootstrap fields let unauthenticated callers probe internal hosts","impact":"medium","summary":"SGLang through 0.5.22, in prefill/decode disaggregation mode, trusts client-supplied bootstrap_host and bootstrap_port fields on the Decode worker's /generate endpoint, so it makes outbound requests to addresses the caller chooses. An unauthenticated attacker can use this to probe internal hosts and ports and to block the shared scheduler loop, delaying other inference requests.","category":"ai-tooling","nicknames":[],"who_cares":["sglang","self-hosted","llm-serving","python"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker maps internal hosts and stalls other inference requests.","analyst_note":"Find the fixed SGLang version and the exact disaggregation launch flag; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112267 and the SGLang release notes.","how_to_check":"- Check the installed SGLang version with `python -c \"import sglang; print(sglang.__version__)\"`; versions through `0.5.22` are in scope.\n- Check whether prefill/decode disaggregation is enabled in the deployment's launch arguments or config (unknown whether the sources name the exact flag).\n- Check whether the Decode worker's /generate endpoint is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["no-disaggregation","private-network","auth-gateway"],"who_is_affected":"Teams running SGLang with prefill/decode disaggregation mode, where the Decode worker's /generate endpoint accepts requests from clients that can reach it. Deployments that run a single-node SGLang server without disaggregation, or keep the Decode worker behind a private network with no untrusted callers, have less exposure. The sources do not say whether the flaw is reachable through any other path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":3366,"output_tokens":794,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112267':15A,18A '-2026':14A,17A '/generate':52B,129C '0.5.22':32B,89C 'address':60B 'ai':20B 'ai-tool':19B 'allow':103C 'attack':66B,105C,120C 'block':78B,138C 'bootstrap':5A,41B,44B,114C,117C 'caller':9A,62B 'choos':63B 'client':3A,39B,112C 'client-suppli':2A,38B,111C 'contain':94C 'craft':122C 'cve':13A,16A 'decod':49B,126C 'delay':83B,143C 'disaggreg':35B,92C 'endpoint':53B,130C 'field':6A,46B,119C 'forgeri':100C 'host':12A,28B,42B,73B,115C,134C 'infer':85B,145C 'intern':11A,72B,133C 'let':7A 'llm':23B 'llm-serv':22B 'loop':82B,142C 'make':56B 'mode':36B,93C 'outbound':57B,108C 'port':45B,75B,118C,136C 'prefill/decode':34B,91C 'probe':10A,71B,132C 'python':25B 'request':58B,86B,99C,109C,123C,146C 'schedul':81B,141C 'self':27B 'self-host':26B 'send':121C 'serv':24B 'server':97C 'server-sid':96C 'sglang':1A,29B,30B,87C 'share':80B,140C 'side':98C 'suppli':4A,40B,113C 'tool':21B 'trigger':107C 'trust':37B 'unauthent':8A,65B,104C 'use':68B 'via':110C 'vulner':101C 'worker':50B,127C","nicknames":[],"mitigations":[],"who_affected":"Teams running SGLang with prefill/decode disaggregation mode, where the Decode worker's /generate endpoint accepts requests from clients that can reach it. Deployments that run a single-node SGLang server without disaggregation, or keep the Decode worker behind a private network with no untrusted callers, have less exposure. The sources do not say whether the flaw is reachable through any other path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112267","severity":null,"published_at":"2026-10-19T14:17:04+00:00","modified_at":"2026-10-19T20:17:53+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}