CVE-2026-3060
Published: 12 March 2026
Summary
CVE-2026-3060 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Lmsys Sglang. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 37.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)).
Deeper analysis
SGLang's encoder parallel disaggregation system contains a deserialization flaw in its disaggregation module that invokes pickle.loads() on untrusted data without any authentication checks. The affected component is exposed in the encode_receiver.py path of the SGLang project and is tracked as CVE-2026-3060 with a CVSS 3.1 score of 9.8 and CWE-502.
An unauthenticated network attacker can supply a malicious serialized payload to the disaggregation endpoint and obtain arbitrary remote code execution, resulting in full confidentiality, integrity, and availability impact on the host. The vulnerability requires no user interaction or credentials and can be reached directly over the network.
The project addressed the issue in release v0.5.10 via pull request 20904, which updates the disaggregation handling to avoid unsafe pickle usage. The referenced Orca Security advisory and GitHub commit history document the change and recommend upgrading to the patched version.
EPSS remains low and unchanged at 0.0194 with no observed rise after disclosure. The finding is specific to an LLM inference framework and underscores risks in distributed serving components that accept serialized inputs.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11559
Vulnerability details
SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote code execution via deserialization of untrusted data in a network-accessible disaggregation module of a public-facing LLM framework application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks unauthenticated network access to the disaggregation endpoint that accepts the malicious pickle payload.
Requires identification and authentication before any interaction with the encode_receiver.py service, eliminating the unauthenticated attack vector.
Mandates validation and sanitization of all input data, preventing unsafe pickle.loads() deserialization of untrusted serialized objects.