CVE-2026-105245

LOW 3.7

sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file python/sglang/srt/entrypoints/http_server.py of the component HTTP Endpoint. Such manipulation of the argument api_key leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

CWE	CWE-319 CWE-310
Vendor	sgl-project
Product	sglang
Published	Oct 5, 2026

Stay Ahead of the Next One

Get instant alerts for sgl-project sglang

Be the first to know when new low vulnerabilities affecting sgl-project sglang are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

sgl-project / sglang

0.5.0 0.5.1 0.5.2 0.5.3 0.5.4 0.5.5 0.5.6 0.5.7 0.5.8 0.5.9 0.5.10 0.5.11 0.5.12 0.5.13 0.5.14 0.5.15 0.5.16 0.5.17 0.5.18 0.5.19 0.5.20 0.5.21

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/413451 vuldb.com: https://vuldb.com/vuln/413451/cti vuldb.com: https://vuldb.com/cve/CVE-2026-105245 vuldb.com: https://vuldb.com/submit/975910 github.com: https://github.com/sgl-project/sglang/issues/30166 github.com: https://github.com/sgl-project/sglang/pull/30343 github.com: https://github.com/sgl-project/sglang/

Credits

🔍 geochen (VulDB User) VulDB CNA Team