Is CVE-2026-15978 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-15978

Description

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.