ГлавнаяУязвимости → CVE-2026-3060
9.8критическая

CVE-2026-3060

Описание

SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.

Затрагиваемое ПО
Lmsys Sglang
CVSS
Балл9.8 — критическая
ВекторCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Источники
https://github.com/sgl-project/sglang/blob/main/python/sglang/srt/disaggregation/encode_receiver.pyhttps://github.com/sgl-project/sglang/pull/20904https://github.com/sgl-project/sglang/releases/tag/v0.5.10https://orca.security/resources/blog/sglang-llm-framework-rce-vulnerabilities/