CVE-2026-15977 sgl-project CVE debrief

Who should care

Organizations using SGLang, especially those with exposed /server_info endpoints, should be aware of this vulnerability and take steps to mitigate it. This includes verifying SGLang configurations, restricting access to the /server_info endpoint, and implementing additional monitoring for API key and SSL keyfile access. Security teams and vulnerability management teams should prioritize this vulnerability due to its HIGH severity and potential impact on sensitive information exposure.

Technical summary

The CVE-2026-15977 vulnerability in SGLang's /server_info endpoint returns sensitive information, including API keys and SSL keyfile details, when accessed with the --admin-api-key configured. This issue has a CVSS score of 7.5 and is classified as HIGH severity. The vulnerability affects SGLang installations with exposed /server_info endpoints, potentially allowing unauthorized access to sensitive information.

Defensive priority

Organizations using SGLang should verify their configurations and consider restricting access to the /server_info endpoint.

Recommended defensive actions

• Verify SGLang configurations to restrict access to the /server_info endpoint
• Consider implementing additional monitoring for API key and SSL keyfile access
• Review and update SGLang installations to ensure proper configuration of the --admin-api-key
• Confirm whether affected SGLang deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record indicates a credential leakage vulnerability in SGLang's /server_info endpoint. The vulnerability returns API keys and SSL keyfile information when only the --admin-api-key is configured. The CVSS score is 7.5 with a HIGH severity. To verify, defenders should review SGLang configurations, check for exposed /server_info endpoints, and monitor API key and SSL keyfile access. Evidence is limited to the CVE record and NVD entry, which may not cover all affected systems or scenarios.

Official resources