CVE-2026-112268 Details
Description
sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination.
An authorization bypass vulnerability has been identified in sglang-router (sgl-model-gateway) versions through 0.3.2. This vulnerability allows holders of the data-plane API key to access mesh high-availability (HA) management routes. The /ha/* endpoints do not properly enforce control-plane Admin role checks, enabling unauthorized access to sensitive management functions. Exploitation of this vulnerability could lead to unauthorized read access of cluster topology, manipulation of gossiped configuration, alteration of global rate limits, and unauthorized shutdown of HA coordination, causing disruption in mesh operations.
The vulnerability has been fixed in version 0.3.2 by requiring control-plane authentication on the mesh HA management routes. Users should update to this version to address the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sgl-project/sglang/issues/45006 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/sgl-project/sglang/blob/v0.5.22/sgl-model-gateway/src/server.rs#L641-L675 | [email protected] | Source CodeVendor |
| https://github.com/sgl-project/sglang/issues/45006 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/sgl-project/sglang/pull/45017 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/sglang-router-through-0.3.2-authorization-bypass-via-mesh-ha-management-routes | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sgl-project sglang-router | <= 0.3.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |