CVE-2026-14890

9.1 criticalEPSS 1.0%

Critical (9.1) in lmsys sglang. EPSS 1.0% chance of exploitation in the next 30 days.

SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2026-07-16
Modified: 2026-08-10
Record from: the NVD, synced 2026-10-19

Affected

lmsys:sglang

References

http://vince.cert.org/vuls/id/326070
https://github.com/sgl-project/sglang/blob/main/python/sglang/srt/elastic_ep/expert_backup_manager.py
https://www.kb.cert.org/vuls/id/326070

Check your stack JSON