---
id: "CVE-2026-112267"
kind: "vulnerability"
aliases: ["CVE-2026-112267"]
title: "SGLang: client-supplied bootstrap fields let unauthenticated callers probe internal hosts"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "llm-serving", "python", "self-hosted", "sglang"]
not_affected_if: ["auth-gateway", "no-disaggregation", "private-network"]
published_at: "2026-10-19T14:17:04+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:40:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112267", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# SGLang: client-supplied bootstrap fields let unauthenticated callers probe internal hosts

SGLang through 0.5.22, in prefill/decode disaggregation mode, trusts client-supplied bootstrap_host and bootstrap_port fields on the Decode worker's /generate endpoint, so it makes outbound requests to addresses the caller chooses. An unauthenticated attacker can use this to probe internal hosts and ports and to block the shared scheduler loop, delaying other inference requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SGLang version with `python -c "import sglang; print(sglang.__version__)"`; versions through `0.5.22` are in scope.
- Check whether prefill/decode disaggregation is enabled in the deployment's launch arguments or config (unknown whether the sources name the exact flag).
- Check whether the Decode worker's /generate endpoint is reachable from untrusted networks.

## Fix

- Upgrade SGLang to a release newer than `0.5.22` (the sources do not name the fixed version: unknown).
- Until patched, restrict network access to the Decode worker's /generate endpoint to trusted clients only.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112267

## From the sources

SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port fields. Attackers sending crafted requests to the Decode worker's /generate endpoint can probe internal hosts and ports and block the shared scheduler loop, delaying other inference requests.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_