SGLang: unauthenticated debug dumper endpoint executes Python in the scheduler process

Impact

An attacker who can reach the dumper port sends a filter expression that escapes the eval() sandbox via re.search __globals__ and runs arbitrary Python inside the SGLang scheduler process on the next forward pass. That process owns the model weights, the GPU context and whatever credentials the serving pod holds, so this is full compromise of the inference workload and a foothold on the GPU node from which to reach the rest of the namespace. No authentication is required on the endpoint. The exposure only exists when DUMPER_SERVER_PORT is set, which is a debug/profiling configuration rather than the default - but it is the kind of setting that gets left on after a performance investigation.

Who can reach it

Anyone with network reach to the SGLang dumper port (DUMPER_SERVER_PORT) - any tenant pod on the same cluster network, or anyone on the internet if the port was published alongside the inference port. Unauthenticated.

What to do

Unset DUMPER_SERVER_PORT and restart the SGLang server - that removes the endpoint immediately and is the fastest mitigation. Affected versions are 0.5.10 through 0.5.22; the record does not name a fixed release, so track the upstream issue for one. Where the dumper is genuinely needed, bind it to localhost and keep it off any shared pod network. Rolling the serving replicas drains in-flight requests but needs no node reboot.

References

Related entries

• vLLM: request-controlled processor code_revision loads arbitrary remote model code, giving RCECVE-2026-114053 · vLLM OpenAI-compatible API server (mm_processor_kwargs.code_revision handling)Critical
• Crawl4AI: file:// URLs accepted by four endpoints let an unauthenticated caller read any file on the hostCVE-2026-26217 · Crawl4AI Docker API (file:// URL handling in /execute_js, /screenshot, /pdf, /html)Critical
• llama.cpp: use-after-free in the RPC server GRAPH_RECOMPUTE handler gives unauthenticated RCECVE-2026-39909 · llama.cpp RPC server (GRAPH_RECOMPUTE handler)Critical
• llama.cpp llama-server: use-after-free on the vocab pointer during idle sleep gives unauthenticated RCECVE-2026-43631 · llama.cpp llama-server (--sleep-idle-seconds idle transition)Critical
• gitlab-mcp: path traversal in job_id redirects API calls to arbitrary GitLab endpointsCVE-2026-61462 · zereight gitlab-mcp (MCP server, job_id parameter in build/index.js)Critical
• Ray (`/log_proxy`): SSRF from the dashboardCVE-2023-48023 · Ray (`/log_proxy`)Critical