CVE-2026-14890VulnerabilityPublished 16 Jul 2026

VU#326070: SGLang contains a vulnerable pickle deserialization vulnerability through the expert-parallel subsystem

Source CERT/CC

Compare

Mentioned vulnerabilities

Not known to be exploited.

Data as of 2 Nov 2026, 22:58 UTC

Severity

Critical

Rated Critical by Threat Radar from the CERT/CC text · No CVSS score from NVD or the CNA

EPSS: 0.9% chance of exploitation in 30 days – higher than 62% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
Public on cve.org; its publication date is not in this record
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Users should immediately restrict network access to the expert-parallel backup subsystem to trusted networks only and implement network segmentation and access controls to prevent unauthorized access. Additionally, users should set the environment variable SGLANG_USE_PICKLE_IPC to "false" in environ.py to disable the vulnerable pickle deserialization feature. Monitor the SGLang project for updates as maintainers are working to replace pickle with safer serialization methods such as msgpack.

Description

A pickle deserialization vulnerability (CVE-2026-14890) exists in the SGLang open-source framework's expert-parallel backup subsystem. This vulnerability allows unauthenticated remote code execution if the subsystem is enabled and reachable over the network. The issue arises because a ZeroMQ PULL socket binds to an external IP without authentication or deserialization safeguards, allowing malicious pickle payloads to be processed. No patch is currently available, and the maintainers have not responded to coordination efforts. Mitigations include disabling the pickle IPC feature and restricting network access to the vulnerable interface.

Impact

An unauthenticated attacker with network access to the expert-parallel backup subsystem of SGLang can achieve remote code execution on the host running the vulnerable service. Deployments exposing this interface to untrusted networks are at high risk. This could lead to full compromise of the affected system.

Summary

SGLang, a framework for serving large language models, contains a remote code execution vulnerability due to unsafe deserialization of pickle data in its expert-parallel backup subsystem. The subsystem exposes a ZeroMQ PULL socket on a routable network interface without authentication, allowing any network-accessible attacker to send malicious pickle payloads that get deserialized, leading to unauthenticated remote code execution. This vulnerability is tracked as CVE-2026-14890 and is similar in nature to CVE-2026-7301 and CVE-2026-7304 but affects a different subsystem. The vulnerability requires that the expert-parallel backup subsystem be enabled and accessible over the network. Until a patch is released, users should disable the pickle IPC feature and restrict network access to the service.

References

kb.cert.org/vuls/id/326070 (opens in a new tab)

Community reviews

Loading reviews…