Vulnerability tracker

The multimodal generation runtime scheduler's ROUTER socket calls pickle.loads() on incoming messages, enabling RCE when exposed to the internet.

This is a different socket from the ZeroMQ broker covered by CVE-2026-3059, which binds to all network interfaces unconditionally. The scheduler ROUTER socket follows the configured --host, which defaults to 127.0.0.1, and is exposed when SGLang is run with --host 0.0.0.0 to serve remote clients.

The multimodal generation runtime accepts file uploads on /v1/images/edits and /v1/videos and uses the client-supplied multipart filename as a filesystem path component without sanitization. A filename containing ../ writes arbitrary files anywhere the server process can write.

SGLang's serving runtime accepts a hex-encoded dill payload in the custom_logit_processor field and deserializes it via dill.loads() without validation. When --enable-custom-logit-processor is set, any client that can reach a generation endpoint can execute code on the host.

The multimodal generation runtime starts a ZeroMQ broker that binds a REP socket on all network interfaces (tcp://*:{server_port + 1}) and calls pickle.loads() on every incoming message. The broker is exposed unconditionally regardless of the --host setting.

Antiproof found this vulnerability independently, and we responsibly disclosed it to the SGLang team on 2026-03-10. On 2026-03-11, Orca Security published a blog post covering the same vulnerability, tracked as CVE-2026-3059 and credited to Orca.

Ray Data's custom Arrow extension types pass deserialization metadata directly to cloudpickle.loads(), so reading a crafted Parquet file that carries such an extension type runs arbitrary code on the worker that processes it.