SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote… (CVE-2026-15978)
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.
AI Analysis
Technical Summary
The vulnerability in SGLang arises when API keys are not configured, causing the software to expose two endpoints. These endpoints permit a remote attacker to initiate distributed weight broadcasting using NCCL (NVIDIA Collective Communications Library), which can then be exploited to exfiltrate all model weights from the system. No CVSS score or patch information is currently available, and no known exploits have been reported in the wild.
Potential Impact
An attacker who can access the exposed endpoints without authentication can remotely trigger data transfer of all model weights, resulting in unauthorized disclosure of potentially sensitive model data. This compromises confidentiality of the model weights.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is available, it is recommended to configure API keys to prevent exposure of these endpoints and restrict access to the service to trusted users only.
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote… (CVE-2026-15978)
Description
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.
CVSS v3.1
Score 7.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in SGLang arises when API keys are not configured, causing the software to expose two endpoints. These endpoints permit a remote attacker to initiate distributed weight broadcasting using NCCL (NVIDIA Collective Communications Library), which can then be exploited to exfiltrate all model weights from the system. No CVSS score or patch information is currently available, and no known exploits have been reported in the wild.
Potential Impact
An attacker who can access the exposed endpoints without authentication can remotely trigger data transfer of all model weights, resulting in unauthorized disclosure of potentially sensitive model data. This compromises confidentiality of the model weights.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is available, it is recommended to configure API keys to prevent exposure of these endpoints and restrict access to the service to trusted users only.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-x6x2-r266-cx9p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-15978"]
Threat ID: 6a6bdd899c2644c7f8da7119
Added to database: 07/30/2026, 23:26:01 UTC
Last enriched: 07/30/2026, 23:31:46 UTC
Last updated: 09/13/2026, 22:01:32 UTC
Views: 43
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.