Beveiligingsadvies

CVE-2026-86793

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-11 11:35:20

Laatst bijgewerkt 2026-09-14 18:51:51

Toegewezen door certcc

CVSS-score 9.8

Status PUBLISHED

Beschrijving

SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE.

← Alle CVE's bekijken Bekijk op cve.org ↗