CVE-2026-86793Disclosure

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code execution via pickle REDUCE.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-94

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
10 mentions across 5 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 7 signals
Disclosure: 5 classified signals
General: 2 classified signals
Peaked 3d ago at 4 mentions (2026-09-13); latest day: 2
10 total mentions across 5 days

Deep dive

Activity timeline10 mentions / 5d

Signal classification4 categories

Disclosure

550.0%

General

220.0%

Patch

220.0%

Active Exploitation

110.0%

Referenced assets1 URL

By indicator

https://vicone.com/blog/cve-2026-86793-sglang-bypass-could-let-attackers-run-code-on-ai-servers/

Classification over time

Date	Total	Labels

2026-09-12	2	Active Exploitation1Disclosure1
2026-09-13	4	Disclosure2General2
2026-09-14	1	Patch1
2026-09-17	1	Disclosure1
2026-09-22	2	Disclosure1Patch1

Full discourse10 posts

VicOne@VicOneAuto35d
Disclosure
CVE-2026-86793: SGLang's SafeUnpickler—the patch for CVE-2025-10164—is vulnerable to bypass. A remote attacker can execute arbitrary code through an unauthenticated endpoint. VicOne researcher Reuel Magistrado details the gadget chain. 🧵(1/6) #ThreatIntelligence #CVE #SGLang
Post summary
The tweet discloses a new vulnerability (CVE-2026-86793) in SGLang's SafeUnpickler that bypasses the patch for CVE-2025-10164, enabling unauthenticated remote code execution via a gadget chain detailed by researcher Reuel Magistrado.
11020154
273 followersView on X
Josh Machado · The Polyglot Programmer@CodePolyglot44d
Disclosure
SGLang shipped a "SafeUnpickler." CVE-2026-86793: __import__+getattr still allowed → unauth RCE via /update_weights_from_tensor when no API key. Ack'd Jul 2. Disclosed Sep 11. No patch. Fourth critical AI-inference RCE in four weeks. Naming it Safe didn't help.
Post summary
The text announces/discloses CVE-2026-86793 with technical details about an unauthenticated RCE in SGLang involving '/update_weights_from_tensor' when no API key is present. It explicitly states there is no patch and does not report PoC sharing, exploit tooling, or active exploitation.
10000173
3.9K followersView on X
VicOne@VicOneAuto35d
Patch
Until SGLang patches, enable authentication immediately. Restrict endpoint access to trusted networks. Read the full analysis and remediation guidance: https://vicone.com/blog/cve-2026-86793-sglang-bypass-could-let-attackers-run-code-on-ai-servers/ 🧵(6/6) #ThreatIntelligence #CVE #SGLang
Post summary
The text advises mitigation steps (authentication and network restrictions) for CVE-2026-86793 until SGLang patches the bypass vulnerability, linking to a detailed analysis and remediation guide.
0000057
273 followersView on X
VicOne@VicOneAuto40d
Disclosure
What if one AI prompt could make the server behind it obey an attacker? VicOne discovered a critical vulnerability, CVE-2026-86793, in SGLang, potentially putting 131,430 servers across 35 countries and regions at risk. #PhysicalAICybersecurity #VulnerabilityResearch https://t.co/nDAU0ujOS2
Post summary
The text announces VicOne's discovery of a critical SGLang vulnerability (CVE-2026-86793), highlighting its potential impact on 131,430 servers globally but lacks technical details, remediation steps, or exploitation evidence.
0000080
273 followersView on X
Er Sonu Saini | DevOps & AI@ErSonusaini143d
Patch
Your open-source LLM server has an unauthenticated RCE hole. 🚨 CVE-2026-86793 (SGLang): no auth keys + a bypassable SafeUnpickler = code execution via /update_weights_from_tensor. No patch published yet. Don't expose that port. #AI #Security #OpenSource
Post summary
The post discloses an unauthenticated RCE vulnerability (CVE-2026-86793) in SGLang's LLM server, notes that no patch is available, and advises users to avoid exposing the affected port as a mitigation.
0000054
130 followersView on X
Slade 🛡️ LLM Hacker@llm_redteam44d
Disclosure
CVE-2026-86793 lets an unauthenticated attacker run code on SGLang inference servers running 0.5.18 or earlier. I went and read the actual denylist logic, and the bug is almost funny. SGLang added SafeUnpickler after CVE-2025-10164 to kill raw pickle RCE. it allowlists "builtins." as a module prefix, then tries to blocklist dangerous names one by one. > ALLOWED_MODULE_PREFIXES: "builtins." > DENY_CLASSES: ("builtins", "eval"), ("builtins", "exec"), etc. problem: builtins.import and builtins.getattr never made the denylist. that's enough. import pulls in any module, getattr resolves any attribute on it. chain those two and you've rebuilt eval/exec out of parts the allowlist already trusts. attacker needs zero creds. the /update_weights_from_tensor endpoint accepts pickle bytes with no auth when SGLang runs default config, which is how most people run it. VicOne's Reuel Magistrado found this. the real lesson isn't the CVE number, it's the pattern: a denylist is permanent maintenance debt against every function in a namespace you already trust wholesale. allowlist by exact symbol, not by module prefix, or this comes back with a different gadget chain in six months. if you run SGLang, check your endpoint auth before you check the patch notes. #SGLang #RCE #LLMSecurity
Post summary
The text discloses CVE-2026-86793, providing a technical breakdown of how flawed denylist logic in SGLang's unpickler allows for unauthenticated remote code execution.
00000157
1.3K followersView on X
Josh Machado · The Polyglot Programmer@CodePolyglot44d
General
https://vicone.com/blog/cve-2026-86793-sglang-bypass-could-let-attackers-run-code-on-ai-servers/
Post summary
The provided text is merely a link to a blog post about CVE-2026-86793 and contains no additional information about PoC, exploits, patches, or active exploitation.
0000049
3.9K followersView on X
devestacion ⚡️@devestacion45d
General
sglang today / cve-2026-86793 / the "safe" unpickler isn't / unauth endpoint runs code on your inference box / you still exposing that to the internet? https://vicone.com/blog/cve-2026-86793-sglang-bypass-could-let-attackers-run-code-on-ai-servers/
Post summary
The text mentions an SGLang vulnerability (CVE‑2026‑86793) but provides no concrete technical details, PoC, exploit code, or mitigation information.
0000045
273 followersView on X
Gavin@gavinz022845d
Active Exploitation
🚨 AI INFRA CRISIS: SGLang just got hit with an unauthenticated RCE (CVE-2026-86793) — the 4th critical CVE in AI infrastructure in just 18 days. No vendor patch yet. AI inference servers are now primary attack surface. Time to audit your stack. #AI #cybersecurity #infosec
Post summary
SGLang’s CVE‑2026‑86793 is an unauthenticated RCE that has already been exploited in the wild, with no vendor patch available yet, urging organizations to audit their AI inference servers.
0000046
13 followersView on X
Swif@swif_ai46d
Disclosure
SGLang's SafeUnpickler blocks eval/exec/open but missed __import__/getattr, letting attackers chain to os.system, unauthenticated. No patch yet-require auth on the endpoint. https://vicone.com/blog/cve-2026-86793-sglang-bypass-could-let-attackers-run-code-on-ai-servers/
Post summary
The post outlines how SGLang’s SafeUnpickler fails to block __import__/getattr, enabling unauthenticated attackers to execute os.system calls; no patch or PoC is provided yet.
0000048
61 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-86793

Josh Machado · The Polyglot Programmer[verified]@CodePolyglotDisclosure

The text announces/discloses CVE-2026-86793 with technical details about an unauthenticated RCE in SGLang involving '/update_weights_from_tensor' when no API key is present. It explicitly states there is no patch and does not report PoC sharing, exploit tooling, or active exploitation.

Er Sonu Saini | DevOps & AI[verified]@ErSonusaini1Patch

The post discloses an unauthenticated RCE vulnerability (CVE-2026-86793) in SGLang's LLM server, notes that no patch is available, and advises users to avoid exposing the affected port as a mitigation.

Slade 🛡️ LLM Hacker[verified]@llm_redteamDisclosure

The text discloses CVE-2026-86793, providing a technical breakdown of how flawed denylist logic in SGLang's unpickler allows for unauthenticated remote code execution.

Josh Machado · The Polyglot Programmer[verified]@CodePolyglotGeneral

The provided text is merely a link to a blog post about CVE-2026-86793 and contains no additional information about PoC, exploits, patches, or active exploitation.

devestacion ⚡️[verified]@devestacionGeneral

The text mentions an SGLang vulnerability (CVE‑2026‑86793) but provides no concrete technical details, PoC, exploit code, or mitigation information.

VicOne@VicOneAutoDisclosure

The tweet discloses a new vulnerability (CVE-2026-86793) in SGLang's SafeUnpickler that bypasses the patch for CVE-2025-10164, enabling unauthenticated remote code execution via a gadget chain detailed by researcher Reuel Magistrado.

VicOne@VicOneAutoPatch

The text advises mitigation steps (authentication and network restrictions) for CVE-2026-86793 until SGLang patches the bypass vulnerability, linking to a detailed analysis and remediation guide.

VicOne@VicOneAutoDisclosure

The text announces VicOne's discovery of a critical SGLang vulnerability (CVE-2026-86793), highlighting its potential impact on 131,430 servers globally but lacks technical details, remediation steps, or exploitation evidence.