SGLang RCE: prove endpoints need auth before patching

The exposure window starts before the advisory

If your SGLang or similar serving stack answers unauthenticated requests on a non-inference endpoint, the exposure window starts when that state becomes reachable, not when the advisory appears. The trade-off is simple: keep the weights-update endpoint open for convenience, or close it and accept the operational cost. The arithmetic is exposure time multiplied by reachability. Exposure time is the interval between first reachable unauthenticated state and closure. Reachability is the set of networks and endpoints that can reach it. A reachable endpoint for a longer interval is worse than a closed endpoint.

SGLang's /update_weights_from_tensor endpoint is marked AuthLevel.ADMIN_OPTIONAL, so it accepts unauthenticated requests when no API key or admin API key is set. CVE-2026-86793 lets an unauthenticated caller trigger pickle deserialization on that endpoint when auth keys are absent. The GitHub advisory for CVE-2026-86793 was published Sep 11, 2026 and last updated Sep 14, 2026. It carries a critical CVSS score of 9.8. VicOne reported that, as of its publication date, SGLang maintainers acknowledged the report but had not supplied a patch or remediation timeline.

The patch is not the control

A code fix changes the path. It does not erase the time the endpoint was reachable. The advisory date is a reporting date, not a control date. For self-hosted LLM security, the control is endpoint configuration: auth, network binding, and disabled features. A denylist bypass is a code defect, but an open port is an operational defect.

SGLang added SafeUnpickler to address an earlier unsafe pickle-loading issue tracked as CVE-2025-10164. SafeUnpickler blocks eval, exec, compile, and open, but leaves __import__ and getattr available. A denylist can reduce the surface, but it does not remove the request path. The model weights are data. The endpoint is the access path. Close the path before relying on the code fix.

Prove the endpoint is locked before you patch

Run this before you patch, because the patch will not retroactively remove the reachable interval. Each item is testable quickly. Use it to prove the endpoint is not reachable without auth, not to wait for a release.

• Inventory non-inference endpoints. Test each with an unauthenticated request and note the response.
• Enforce auth on every endpoint. Confirm a missing key returns an auth error, not success.
• Bind the serving port to a private network. Verify external scanners cannot reach it.
• Disable dumper, LoRA, and weights-update endpoints. Confirm they return not found or forbidden.
• Calculate exposure: subtract the date your endpoint began accepting unauthenticated requests from the public disclosure date.

Start from outside the private network. Use a client that has no credentials. Request the endpoint and record the response. A successful response means the endpoint is reachable without auth. An auth error means the control is in place. A not-found response means the route is hidden, but hidden is not the same as closed.

Check the serving port from a host that should not have access. If the port answers, the network boundary is not doing its job. Bind the port to the private interface, then test again. Retest until the endpoint fails before it can be used.

Check the admin path separately. Some serving stacks expose a management surface for weights, LoRA, or model state. If that surface accepts a request without a key, it is reachable. If it requires a key, record which key type it accepts. The distinction matters when you rotate keys or disable features. Repeat the test after every config change.

Treat reachable exposure as real

Log the date it began, the date you closed it, and the path an attacker could have used. Patching stops future code execution, but it does not shorten the window. Keep the disabled state until the code path is closed.

Rotate any key that was in use during the window. If no key was in use, the absence of a key is the finding. Record the key status in the same log.