CVE-2026-111392 Details
Description
SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.
A vulnerability exists in SGLang versions through 0.5.21, where the application improperly trusts caller-supplied 'mm_hashes' values as keys for the multimodal prefix cache. This flaw allows remote attackers to poison cached key-value entries across different requests. By sending a different image under a known or predicted hash via the '/generate' endpoint, attackers can either disclose the content of another request's image or corrupt the responses of victims.
Users can launch the server with the '--trust-caller-mm-hashes' flag to opt-in to trusting caller-supplied hashes. By default, this option is disabled, and the server will recompute hashes based on the actual image content, preventing cache hijacking. The fix has been implemented in SGLang version 0.5.21.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sgl-project/sglang/issues/44641 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/managers/io_struct.py#L205-L215 | [email protected] | Source CodeVendor |
| https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/managers/tokenizer_manager.py#L1183-L1215 | [email protected] | Source CodeVendor |
| https://github.com/sgl-project/sglang/issues/44641 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/sgl-project/sglang/pull/44653 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/sglang-through-0.5.21-kv-cache-poisoning-via-mm-hashes-in-generate | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SGLang | >= 0.5.13, <= 0.5.21 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |