Authorization Bypass Vulnerability in sglang-router by SGL Project

CVE-2026-112268

What is CVE-2026-112268?

The sglang-router component of the sgl-model-gateway prior to version 0.3.2 is susceptible to an authorization bypass vulnerability. Attackers possessing a data-plane API key can exploit this weakness, which permits unauthorized access to mesh HA management endpoints. This flaw results in the ability to bypass crucial control-plane Admin role checks on the /ha/* endpoints, potentially allowing malicious actors to expose cluster topology, modify critical configurations, alter global rate limiting settings, and issue command requests to shutdown HA coordination without proper authentication.

References