What happened
SGLang, an open-source high-performance LLM/multimodal-model serving framework (used in production inference and physical-AI/robotics reasoning layers), contains a deserialization bypass in its SafeUnpickler component. SafeUnpickler was introduced to fix an earlier deserialization CVE (CVE-2025-10164) by restricting which Python modules/classes could be loaded via an allowlist (ALLOWED_MODULE_PREFIXES) and denylist (DENY_CLASSES). The 'builtins.' prefix allowlist is overly broad, and the denylist blocks eval/exec/compile/open but not __import__ or getattr, allowing an attacker to chain these primitives into a gadget chain that reaches arbitrary functions in any importable module. The vulnerable /update_weights_from_tensor endpoint is marked AuthLevel.ADMIN_OPTIONAL and accepts unauthenticated requests when no API key is configured. The flaw was reported to CERT/CC on July 16, 2026; the maintainer acknowledged it July 2 but had not shipped a patch as of the September 11, 2026 public technical disclosure by VicOne researcher Reuel Magistrado.
Why it matters
SGLang is a widely-used LLM inference server (created by LMSYS) that also underlies physical-AI/robotics reasoning-and-inference layers. Unauthenticated RCE at the inference-server layer gives an attacker full control of the host serving model weights and predictions — the blast radius covers every model hosted and every downstream application depending on that server. It is the fourth in an accelerating (~monthly-to-weekly) sequence of critical AI-stack CVEs (NemoClaw/Ollama, DeepSeek Harness, IBM Langflow, now SGLang) confirming that AI serving infrastructure has become a primary attack target, and no vendor patch was available at time of public disclosure.
Attack vector
Unauthenticated POST to the /update_weights_from_tensor endpoint carrying a crafted pickle payload that chains __import__ and getattr gadgets past the incomplete SafeUnpickler denylist to reach arbitrary Python functions (e.g., os.system).
Affected systems
SGLang (open-source LLM inference server), all versions with SafeUnpickler and no API key configured, prior to a fix
Mitigation
No vendor patch was available at the time of disclosure (Sept 11, 2026); operators should require API-key authentication on all SGLang endpoints and avoid exposing /update_weights_from_tensor to untrusted networks pending an upstream fix.