CVE-2026-3060 - Vulnerability Analysis

Overview

SGLang encoder parallel disaggregation system contains an insecure deserialization vulnerability caused by unauthenticated use of pickle.loads() in the disaggregation module, letting remote attackers execute arbitrary code without authentication.

Severity & Score

Impact

Remote attackers can execute arbitrary code without authentication, potentially leading to full system compromise.

Mitigation

Update to the latest version with secure deserialization or apply patches to validate input before deserialization.

References

• https://github.com/sgl-project/sglang/blob/main/python/sglang/srt/disaggregation/encode_receiver.py
• https://orca.security/resources/blog/sglang-llm-framework-rce-vulnerabilities/

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 12, 2026

🔴 CVE-2026-3060 - Critical (9.8) SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3060/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner