PT-2026-66558 · Sglang · Sglang
CVE-2026-15969
·
Published
2026-07-30
·
Updated
2026-07-30
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
SGLang contains an unauthenticated RCE in /load lora adapter from tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sglang