CVE-2026-112268Medium· 6.3▾ Sunlitsglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination.
sglang-router <= 0.3.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112267Medium· 6.5SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker
CVE-2026-112270Medium· 6.5SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx
CVE-2026-112269Medium· 6.5SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations
CVE-2026-112266Medium· 5.9SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching
CVE-2026-112083Medium· 5.3sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service
CVE-2026-112082High· 7.5sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of service