CVE-2026-92972Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rank_ip and rank_port values to redirect decode workers to attacker-controlled endpoints, causing denial of service or disclosure of KV transfer metadata including session identifiers and tensor-parallel topology parameters.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

akmal@akmal_mzkki45d
Disclosure
Laporan keamanan CVE-2026-92972 resmi membeberkan celah berisiko tinggi (skor CVSS 8.6) pada framework inferensi LLM populer, SGLang, per 18 September 2026. Kerentanan ini menyasar klaster GPU yang menjalankan mode disagregasi prefill dan decode. https://t.co/4xDjWcrqLn
Post summary
A security report discloses a high‑severity (CVSS 8.6) vulnerability in the SGLang LLM inference framework, affecting GPU clusters that run disaggregated prefill and decode modes, with no PoC, exploit tool, or confirmed active exploitation mentioned.
1000048
127 followersView on X

Explore more

Back to dashboard