CVE-2026-105245: Cleartext Transmission of Sensitive Information in sgl-project sglang

This vulnerability affects the server_info function in the file python/sglang/srt/entrypoints/http_server.py of sgl-project sglang versions up to 0.5.21. The issue arises from the cleartext transmission of the api_key parameter, which is sensitive information. The vulnerability is remotely exploitable, but the attack complexity is high. Although the exploit has been publicly disclosed, no official patch has yet been accepted, leaving the vulnerability unpatched at this time.

Sensitive information (api_key) is transmitted in cleartext, which could allow an attacker with network access to intercept this data. The vulnerability is remotely exploitable but requires a complex attack. There is no indication of privilege escalation or other impacts beyond information disclosure.

A pull request containing a fix for this vulnerability has been submitted but is not yet accepted. Until the fix is officially integrated, users should consider mitigating the risk by avoiding transmitting sensitive information over unencrypted channels or applying manual patches if feasible. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.