SGLang, one of the most widely deployed open-source frameworks for serving large language models, contains a critical flaw that lets an unauthenticated attacker run arbitrary code on the inference server. The vulnerability, tracked as CVE-2026-86793, affects versions up to and including 0.5.14 and had no vendor patch when it was published publicly on 11 September.
The bug is a lesson in how a too-narrow allowlist can fail while looking exactly as intended. SGLang introduced a custom unpickler, SafeUnpickler, after an earlier deserialization flaw (CVE-2025-10164) allowed code execution through malicious pickle data. The class restricts which modules, classes and functions may be resolved during deserialization using two lists: permitted module prefixes such as "torch." and "numpy.", and a denylist of specific dangerous pairs such as ("builtins", "eval").
The prefix "builtins." is too broad. It permits every name in the builtins module that is not explicitly denied — and the denylist blocks eval, exec, compile and open, but not __import__ or getattr. Chained through two pickle opcodes, those two permitted functions reach anything importable. VicOne researcher Reuel Magistrado's proof of concept resolves builtins.__import__ to import os, calls builtins.getattr to fetch os.system without ever asking the unpickler to resolve ("os", "system") directly, then invokes it. The restrictions are bypassed not by breaking the rules, but by staying inside them.
Reaching the code path requires a POST to SGLang's /update_weights_from_tensor endpoint, which is declared ADMIN_OPTIONAL: when neither an API key nor an admin key is configured, the endpoint accepts requests with no authentication at all. The payload travels as a base64-encoded pickle inside the serialized_named_tensors array. The flaw is therefore exploitable only against servers that are both reachable and unauthenticated — a configuration common in internal deployments and lab clusters, and not rare on the open internet.
The disclosure timeline is its own story. Magistrado filed a private advisory with the maintainers on 29 June, followed up by email, and received an acknowledgement through Slack on 2 July — with no patch or remediation timeline. On 16 July he escalated to CERT/CC for coordinated disclosure. CERT/CC validated the flaw on 30 July and assigned the CVE on 8 September; VicOne published its analysis on 11 September, with no fix yet shipped. CERT/CC's advisory, VU#281278, covers six vulnerabilities in SGLang, including remote code execution and server-side request forgery.
The practical advice until a patch lands is unglamorous: configure authentication, bind SGLang behind a trusted network, and restrict access to the weights-update endpoint. The proposed code fix is similarly small — add __import__, getattr, setattr and delattr to the denylist, or better, drop the broad "builtins." prefix and allow only the exact classes tensor serialization needs.
The context makes it worse: CVE-2026-86793 is the latest in a run of serious flaws in AI inference infrastructure disclosed in recent weeks, from Ollama to Langflow — a reminder that the servers holding model weights and compute now sit on the same trust boundary as the applications they serve.
