CVE-2026-7301

The scheduler of the multimodal module in SGLang binds the ROUTER socket to address 0.0.0.0, which accepts connections from all network interfaces. Data sent to this socket is passed directly to the pickle.loads() function, which deserializes a Python object without any validation or authentication of the sender. An attacker can craft a malicious pickle payload and send it to the open socket, forcing arbitrary code execution in the context of the SGLang process.

An attacker gains the ability to remotely execute arbitrary code (RCE) on the server without requiring any privileges or user interaction, which can lead to complete system takeover, data theft, and violation of confidentiality, integrity, and availability.

Apply patches available from the vendor according to the references. Until updates are applied, it is recommended to restrict access to the ROUTER socket using a firewall or network rules so that the port is not accessible from untrusted networks or the public internet. SGLang should not be exposed directly to the internet without an authentication layer.

Lmsys SGLang product — versions indicated in the vendor references; the multimodal generation runtime scheduler component with default ROUTER socket configuration is vulnerable.