CVE-2026-3059
Published: 12 March 2026
Description
SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker, which deserializes untrusted data using pickle.loads() without authentication.
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of untrusted inputs to the ZMQ broker prior to deserialization, directly preventing execution of malicious payloads via pickle.loads().
Mandates identification, reporting, and correction of the specific deserialization flaw, enabling application of the vendor patch from SGLang release v0.5.10.
Implements boundary protection to monitor and control network communications to the exposed ZMQ broker, blocking unauthenticated remote access by attackers.
Security SummaryAI
CVE-2026-3059 is a critical vulnerability in SGLang's multimodal generation module, where the ZMQ broker deserializes untrusted data using pickle.loads() without authentication, enabling unauthenticated remote code execution. Published on 2026-03-12, it is associated with CWE-502 (Deserialization of Untrusted Data) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network-accessible nature and comprehensive impact on system confidentiality, integrity, and availability.
Any unauthenticated attacker with network access to the affected SGLang deployment can exploit this flaw by transmitting malicious serialized data to the ZMQ broker. Successful exploitation results in arbitrary remote code execution on the server, with no requirement for user privileges or interaction, potentially allowing full compromise of the hosting environment.
Mitigation details are outlined in the SGLang GitHub security advisory (GHSA-3cp7-c6q2-94xr), which references a fix in pull request #20904 and release v0.5.10. The vulnerable code is visible in scheduler_client.py, and further analysis appears in the Orca Security blog post on SGLang LLM framework RCE vulnerabilities.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote code execution via deserialization in a network-accessible ZMQ broker in SGLang directly enables exploitation of a public-facing application.