SGLang: unauthenticated pickle deserialization in the ZMQ decoder gives code execution as the server process

Impact

The ZMQ message decoder calls pickle.loads() on PickleWrapper payloads in _maybe_unwrap_pickle with no type allowlist and no authentication, so anything that can deliver a message on the inter-process channel runs arbitrary Python as the serving process. Setting SGLANG_USE_PICKLE_IPC=0 does not close it: the msgpack path still reaches the same unwrap. On a node running SGLang the process owns the GPUs, the loaded weights and whatever credentials the serving pod holds, so this is a full takeover of the inference worker and a foothold for lateral movement to the rest of the serving tier. It becomes network-reachable rather than local when data-parallel attention is enabled with a --dist-init-addr bound to a non-loopback address, which is the normal configuration for multi-node serving.

Who can reach it

Locally, any process that can reach the SGLang ZMQ sockets. Remotely and unauthenticated when data-parallel attention is on and --dist-init-addr is a non-loopback address - anyone who can route to that port on the training/serving network. No credentials are required in either case.

What to do

Treat the SGLang IPC/dist-init ports as untrusted and keep --dist-init-addr on loopback or a tenant-isolated network segment until a fixed release is adopted; disabling SGLANG_USE_PICKLE_IPC is explicitly not a mitigation. The record points only at the project tree and the researcher write-up and names no fixed version, so plan on upgrading to current main once the maintainers ship the allowlist and restarting each serving replica - a rolling daemon restart per model server, no node reboot.

References

Related entries

• MLflow (mlflow server / mlflow ui, Model Registry): REMOTE FILE ACCESS on the host running the tracking and registryNCVD-2023-010-mlflow-mlflow-server-mlflow-ui-m · MLflow (mlflow server / mlflow ui, Model Registry)Critical
• ClearML API server: CSRF against the API serverCVE-2024-24593 · ClearML API serverCritical
• llama-cpp-python: RCE via Jinja2 template in a GGUF model's metadata (`Llama` class)CVE-2024-34359 · llama-cpp-pythonCritical
• Jupyter Server Proxy: Unauthenticated web access to a user's proxied processesCVE-2024-35225 · Jupyter Server ProxyCritical
• Langflow OSS: submitted components run arbitrary Python as root on the serverCVE-2026-12944 · IBM Langflow OSS (component code validation / sandbox)Critical
• MLflow Assistant: missing origin validation lets a web page drive the local Assistant into command executionCVE-2026-2611 · MLflow Assistant /ajax-api endpoints (origin validation)Critical