Credential Leakage Vulnerability in SGLang Affected by Admin API Key Configuration

CVE-2026-15977

What is CVE-2026-15977?

SGLang contains a vulnerability within its /server_info endpoint that can lead to the unintentional exposure of sensitive data, including API keys and SSL keyfile information. This occurs specifically when the system is configured with only the --admin-api-key. The situation poses a risk for unauthorized access to crucial cryptographic material, potentially compromising the overall security of systems that rely on SGLang.

References