Signal is active with 1 mentions in latest observed window
Immediate actions
Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
A security flaw has been discovered in lmsys sglang 0.4.6. Affected by this vulnerability is the function main of the file /update_weights_from_tensor. The manipulation of the argument serialized_named_tensors results in deserialization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Peaked 1d ago at 1 mentions (2026-09-13); latest day: 1
2 total mentions across 2 days
Deep dive
>Activity timeline2 mentions / 2d
>Signal classification1 categories
Disclosure
2100.0%
>Full discourse2 posts
VicOne@VicOneAuto·
Disclosure
CVE-2026-86793: SGLang's SafeUnpickler—the patch for CVE-2025-10164—is vulnerable to bypass. A remote attacker can execute arbitrary code through an unauthenticated endpoint. VicOne researcher Reuel Magistrado details the gadget chain. 🧵(1/6)
#ThreatIntelligence#CVE#SGLang
Post summary
The announcement describes a new bypass vulnerability in SGLang's SafeUnpickler, enabling remote code execution through an unauthenticated endpoint, with technical details about the gadget chain provided by a researcher.
CVE-2026-86793 lets an unauthenticated attacker run code on SGLang inference servers running 0.5.18 or earlier.
I went and read the actual denylist logic, and the bug is almost funny.
SGLang added SafeUnpickler after CVE-2025-10164 to kill raw pickle RCE. it allowlists "builtins." as a module prefix, then tries to blocklist dangerous names one by one.
> ALLOWED_MODULE_PREFIXES: "builtins."
> DENY_CLASSES: ("builtins", "eval"), ("builtins", "exec"), etc.
problem: builtins.import and builtins.getattr never made the denylist.
that's enough. import pulls in any module, getattr resolves any attribute on it. chain those two and you've rebuilt eval/exec out of parts the allowlist already trusts.
attacker needs zero creds. the /update_weights_from_tensor endpoint accepts pickle bytes with no auth when SGLang runs default config, which is how most people run it.
VicOne's Reuel Magistrado found this. the real lesson isn't the CVE number, it's the pattern: a denylist is permanent maintenance debt against every function in a namespace you already trust wholesale. allowlist by exact symbol, not by module prefix, or this comes back with a different gadget chain in six months.
if you run SGLang, check your endpoint auth before you check the patch notes.
#SGLang#RCE#LLMSecurity
Post summary
The tweet announces and thoroughly analyzes CVE-2026-86793, detailing a technical RCE bypass in SGLang's SafeUnpickler logic via allowlist/denylist bypass, but does not reference a PoC, exploit tool, active exploitation, or specific patch.
