SGLang: unauthenticated PUT /route poisons the KV transfer routing table in disaggregated mode

Impact

In prefill/decode disaggregation mode the prefill bootstrap service exposes an unauthenticated PUT /route endpoint that accepts arbitrary rank_ip and rank_port values. Anyone who can reach that port can point decode workers at an endpoint they control, which stops serving for the affected ranks and leaks KV transfer metadata - session identifiers and tensor-parallel topology parameters. Disaggregated deployments are exactly the large multi-node setups where a single poisoned route can idle a whole block of GPUs, and the bootstrap port is usually treated as internal plumbing rather than an authenticated API, so it is often bound wider than intended. Recovery means restarting the affected workers, which drops their KV cache and in-flight requests.

Who can reach it

Anyone with network reach to the prefill bootstrap service port - any tenant pod on the same cluster network, or anything on the inference VLAN if the port is not firewalled. No authentication required.

What to do

No fixed version is named in the record (affected through 0.5.19); track the upstream issue. Until a release lands, restrict the bootstrap port to the serving nodes themselves with network policy or host firewall rules and keep disaggregation traffic off any tenant-reachable network. Applying a fix or restricting the port is a serving-process restart, not a node reboot.

References

Related entries

• vLLM OpenAI-compatible server (qwen3_coder tool-call parser): Code execution inside the serving process, which on a GPUNCVD-2025-017-vllm-openai-compatible-server-qw · vLLM OpenAI-compatible server (qwen3_coder tool-call parser)High
• vLLM (multimodal prompt embeddings, sparse tensor validation): This is the advisory saying the earlier fix did notNCVD-2026-043-vllm-multimodal-prompt-embedding · vLLM (multimodal prompt embeddings, sparse tensor validation)High
• MLflow (statsmodels flavor, MLFLOW_ALLOW_PICKLE_DESERIALIZATION guard): SECURITY CONTROL BYPASS LEADING TO RCE: theNCVD-2026-054-mlflow-statsmodels-flavor-mlflow · MLflow (statsmodels flavor, MLFLOW_ALLOW_PICKLE_DESERIALIZATION guard)High
• Pure Storage FlashArray authentication input validation: Malformed input during authentication takes the FlashArrayCVE-2025-0051 · Pure Storage FlashArray authentication input validationHigh
• Ollama: malformed base64 image data crashes the model runner via null pointer dereferenceCVE-2025-15514 · Ollama (multi-modal image handling in /api/chat)High
• skops (scikit-learn model sharing): Inconsistency in the `Operator` handling lets an untrusted model bypass the safeCVE-2025-54412 · skops (scikit-learn model sharing)High