Cleartext Transmission Vulnerability in sgl-project sglang HTTP Endpoint
CVE-2026-105245

6.3MEDIUM

Key Information:

Vendor: Sgl-project
Status: Sglang
Vendor: CVE Published:; 5 October 2026

🔔 Create Sgl-project Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-105245?

A vulnerability exists in sgl-project sglang that allows an attacker to exploit the server_info function in the HTTP Endpoint. This issue arises from improper handling of the api_key argument, which can result in sensitive information being transmitted in cleartext. The vulnerability is present in versions up to 0.5.21 of sglang, and the attack can be executed remotely. Although the likelihood of exploitation is complex, the disclosure of the exploit means that it could potentially be used in the wild. A pull request to address this vulnerability is currently pending acceptance.

Affected Version(s)

sglang 0.5.0

sglang 0.5.1

sglang 0.5.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-105245 - Proof of Concept