Introduction

During our ongoing AI research into Nvidia Dynamo’s distributed inference capabilities, we discovered critical remote code execution vulnerabilities in SGLang, a popular open-source framework for serving Large Language Models. While conducting security assessments of AI infrastructure components, we identified that SGLang’s ZMQ (ZeroMQ) broker implementation contains severe pickle deserialization vulnerabilities that allow unauthenticated remote attackers to execute arbitrary code. Interestingly, we later discovered that Orca Security had independently identified these same vulnerabilities and published their research findings. However, despite responsible disclosure efforts and submitted patch requests, the SGLang team has not responded or implemented fixes, leaving users exposed to these critical security risks.

Background: Understanding the AI Infrastructure Stack

Nvidia Dynamo

Nvidia Dynamo is a distributed inference framework designed to handle large-scale AI model serving across multiple GPUs and nodes. It provides sophisticated orchestration capabilities for:

• Distributed model serving: Spreading large models across multiple GPUs
• Request routing: Intelligent load balancing and request distribution
• Backend abstraction: Supporting multiple inference engines including SGLang
• Scalable architecture: Handling high-throughput inference workloads

Dynamo acts as a middleware layer that abstracts the complexity of distributed AI inference, allowing organizations to deploy and scale AI models efficiently across their infrastructure.

SGLang Framework

SGLang (Structured Generation Language) is an open-source framework specifically designed for serving Large Language Models with advanced generation capabilities. Key features include:

• Multimodal support: Text, image, and video generation capabilities
• Structured generation: Support for constrained and guided text generation
• High performance: Optimized inference engine with CUDA acceleration
• ZMQ-based communication: Uses ZeroMQ for inter-process communication
• Disaggregated serving: Separates encoding and decoding phases for efficiency

SGLang has gained significant adoption in the AI community due to its performance optimizations and support for complex generation tasks.

Vulnerability Discovery

During our security research of Nvidia Dynamo’s integration with SGLang backends, we identified critical vulnerabilities in SGLang’s network communication layer. Our analysis focused on the ZMQ broker implementation used for coordinating distributed inference tasks.

The Technical Details

The vulnerability exists in SGLang’s multimodal generation runtime, specifically in the scheduler_client.py file at line 29 where unsafe pickle deserialization occurs on network data without validation. SGLang’s ZMQ broker blindly deserializes incoming network data using Python’s pickle.loads() function without any authentication or validation. This creates a classic remote code execution vector through unsafe deserialization.

Attack Vector Analysis

1. Network Exposure: The ZMQ broker binds to tcp://* (all interfaces) by default on port http_port + 1
2. No Authentication: Any network client can connect without credentials
3. Immediate Execution: Code execution occurs during pickle.loads() before any validation

Proof of Concept

We successfully demonstrated TCP-based remote code execution against a live SGLang instance using a malicious pickle payload that executes arbitrary commands during deserialization. Exploit Execution: The following screenshot shows our TCP-based RCE exploit successfully executing against the SGLang ZMQ broker: The attack successfully created evidence files demonstrating full remote code execution with complete system access:

Cross-Reference with Orca Security Research

Our findings align perfectly with Orca Security’s independent research, which identified three critical CVEs:

• CVE-2026-3059: Multimodal generation ZMQ broker (CVSS 9.8)
• CVE-2026-3060: Disaggregation encoder receiver (CVSS 9.8)
• CVE-2026-3989: Crash dump replay script (CVSS 7.8)

Orca Security’s analysis confirms the same root cause we identified: unsafe pickle deserialization in network-facing components. Their research validates that affected versions include 0.5.5 through 0.5.9+ when multimodal or disaggregation features are enabled.

Impact Assessment

The impact of these vulnerabilities is severe:

Critical Risk Factors

• Unauthenticated RCE: No credentials required
• Network accessible: Exploitable over TCP/IP
• Immediate execution: No user interaction needed
• Full system compromise: Complete process privileges

Real-World Implications

• AI Infrastructure compromise: Attackers can take control of ML serving infrastructure
• Data exfiltration: Access to models, training data, and inference results
• Lateral movement: Use compromised AI servers as pivot points
• Supply chain attacks: Compromise AI services affecting downstream applications

Responsible Disclosure Timeline

Based on Orca Security’s disclosure timeline and our own findings:

1. Vulnerability discovered: Multiple researchers identified the issue
2. Patch submitted: Community contributors submitted fix PRs
3. No response: SGLang maintainers have not responded to disclosure efforts
4. Public disclosure: Releasing details due to lack of vendor response

Current Status and Recommendations

As of this publication, no official patches exist for these critical vulnerabilities. The SGLang team has not responded to responsible disclosure efforts, leaving the entire user base exposed.

Immediate Actions Required

1. Network Isolation: Restrict SGLang ZMQ broker access via firewall rules
2. Monitoring: Implement network monitoring for suspicious ZMQ traffic
3. Alternative frameworks: Consider switching to patched alternatives
4. Container security: Use network policies to limit SGLang network access

Long-term Solutions

The SGLang project needs to: – Replace pickle with safe serialization formats (JSON, MessagePack, Protocol Buffers) – Implement authentication for ZMQ communications – Add input validation before deserialization – Establish a security response process

Conclusion

The discovery of these critical RCE vulnerabilities in SGLang highlights the importance of security-first development in AI infrastructure. As AI systems become increasingly distributed and network-connected, traditional security principles become even more critical. The lack of vendor response to these critical vulnerabilities is concerning and demonstrates the need for the AI community to prioritize security alongside performance and features. Organizations using SGLang should immediately implement the recommended mitigations and consider alternative solutions until official patches are available. We commend Orca Security for their thorough research and responsible disclosure efforts. This case serves as a reminder that the AI boom must not come at the expense of fundamental security practices.

---

About FORTBRIDGE: We provide specialized cybersecurity services for AI and ML infrastructure, helping organizations secure their AI deployments against emerging threats. Our research team continuously analyzes AI frameworks and tools to identify security vulnerabilities before they can be exploited.

About Post Author