{"id":"CVE-2026-112268","kind":"vulnerability","aliases":["CVE-2026-112268"],"related":[],"title":"sglang-router: data-plane API key reaches HA admin routes and shutdown","description":"sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination.","summary":"sglang-router (sgl-model-gateway) through 0.3.2 lets holders of the data-plane API key reach /ha/* management endpoints, because those routes skip the control-plane Admin role check. An attacker with that key can read cluster topology, change gossiped configuration and global rate limits, and call POST /ha/shutdown to dissolve HA coordination.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-gateway","ai-tooling","llm-serving","self-hosted","sgl-model-gateway","sglang"],"not_affected_if":["data-plane-key-not-shared","single-router-no-ha"],"how_to_check":"- Find the installed sglang-router or sgl-model-gateway version and compare it with the sources' fixed release, which the sources do not name\n- Check whether the router exposes /ha/* endpoints on a network the data-plane key can reach\n- unknown whether the sources describe a configuration-only check","fix":"- Upgrade sglang-router / sgl-model-gateway past `0.3.2` (fixed version unknown from the sources)\n- Rotate the data-plane API key if it may have been shared beyond trusted clients\n- Restrict access to /ha/* at the network layer until upgraded","status":"open","published_at":"2026-10-19T14:17:04+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:01:45+00:00","updated_at":"2026-10-25T04:01:45+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T04:01:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade sglang-router / sgl-model-gateway past `0.3.2` (fixed version unknown from the sources)\n- Rotate the data-plane API key if it may have been shared beyond trusted clients\n- Restrict access to /ha/* at the network layer until upgraded","reach":"network","title":"sglang-router: data-plane API key reaches HA admin routes and shutdown","impact":"medium","summary":"sglang-router (sgl-model-gateway) through 0.3.2 lets holders of the data-plane API key reach /ha/* management endpoints, because those routes skip the control-plane Admin role check. An attacker with that key can read cluster topology, change gossiped configuration and global rate limits, and call POST /ha/shutdown to dissolve HA coordination.","category":"ai-tooling","nicknames":[],"who_cares":["sglang","sgl-model-gateway","ai-gateway","self-hosted","llm-serving"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads topology, changes rate limits, dissolves HA coordination","analyst_note":"Find the fixed version and whether /ha/* is exposed by default; check NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-112268 and the upstream sglang repository advisory.","how_to_check":"- Find the installed sglang-router or sgl-model-gateway version and compare it with the sources' fixed release, which the sources do not name\n- Check whether the router exposes /ha/* endpoints on a network the data-plane key can reach\n- unknown whether the sources describe a configuration-only check","needs_analyst":true,"not_affected_if":["single-router-no-ha","data-plane-key-not-shared"],"who_is_affected":"Teams running sglang-router or sgl-model-gateway through 0.3.2 in high-availability mode, where data-plane API keys are issued to clients or services. Exposure depends on whether those keys reach untrusted callers. Deployments that run a single router without HA mesh, or that never share data-plane keys beyond trusted services, have a smaller exposure; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":3361,"output_tokens":773,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112268':17A,20A '-2026':16A,19A '/ha':57B,126C '/ha/shutdown':90B,150C '0.3.2':46B,103C 'access':120C 'admin':11A,68B,132C 'ai':22B,25B 'ai-gateway':21B 'ai-tool':24B 'allow':110C 'api':7A,54B,117C 'attack':72B,135C 'author':106C 'bypass':107C 'call':88B,148C 'chang':80B,143C 'check':70B,134C 'cluster':78B,138C 'configur':82B,142C 'contain':104C 'control':66B,130C 'control-plan':65B,129C 'coordin':94B,155C 'cve':15A,18A 'data':5A,52B,115C 'data-plan':4A,51B,114C 'dissolv':92B,153C 'endpoint':59B,127C 'gateway':23B,36B,44B,101C 'global':84B,144C 'gossip':81B,141C 'ha':10A,93B,122C,154C 'holder':48B,111C 'host':32B 'key':8A,55B,75B,118C 'let':47B 'limit':86B,146C 'llm':28B 'llm-serv':27B 'manag':58B,123C 'mesh':121C 'model':35B,43B,100C 'plane':6A,53B,67B,116C,131C 'post':89B,149C 'rate':85B,145C 'reach':9A,56B 'read':77B,137C 'role':69B,133C 'rout':12A,62B,124C 'router':3A,40B,97C 'self':31B 'self-host':30B 'serv':29B 'sgl':34B,42B,99C 'sgl-model-gateway':33B,41B,98C 'sglang':2A,37B,39B,96C 'sglang-rout':1A,38B,95C 'shutdown':14A 'silent':152C 'skip':63B,128C 'tool':26B 'topolog':79B,139C 'vulner':108C 'write':140C","nicknames":[],"mitigations":[],"who_affected":"Teams running sglang-router or sgl-model-gateway through 0.3.2 in high-availability mode, where data-plane API keys are issued to clients or services. Exposure depends on whether those keys reach untrusted callers. Deployments that run a single router without HA mesh, or that never share data-plane keys beyond trusted services, have a smaller exposure; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112268","severity":null,"published_at":"2026-10-19T14:17:04+00:00","modified_at":"2026-10-22T03:16:36+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}