CVE-2026-112268: falha de média gravidade em sgl-project sglang-router
sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
sgl-project · sglang-routerReferências
https://github.com/sgl-project/sglang/blob/v0.5.22/sgl-model-gateway/src/server.rs#L641-L675https://github.com/sgl-project/sglang/issues/45006https://github.com/sgl-project/sglang/pull/45017https://www.vulncheck.com/advisories/sglang-router-through-0.3.2-authorization-bypass-via-mesh-ha-management-routes