SGLang Sandbox Escape in Dumper Endpoint Enables Remote Code Execution

A critical code injection vulnerability in SGLang enables remote attackers to execute arbitrary Python code within the scheduler process. This flaw affects versions 0.5.10 through 0.5.22 and allows unauthenticated exploitation via a specific configuration endpoint.

What happened

The National Vulnerability Database records CVE-2026-111391 as a critical-severity issue with a CVSS score of 9.2. The flaw resides in the _evaluate_filter() function within SGLang versions ranging from 0.5.10 to 0.5.22. Attackers can manipulate this function to escape the intended eval() sandbox by leveraging re.search __globals__. This technique permits the execution of unauthorized Python code on the server.

Exploitation occurs when an attacker sends a crafted filter expression to the /dumper/configure endpoint. This endpoint is unauthenticated, meaning no login credentials are required to interact with it. The attack succeeds only if the DUMPER_SERVER_PORT environment variable is configured on the system. Once the request is processed, the malicious code runs within the scheduler process during the next forward pass.

Why it matters

This vulnerability grants remote code execution to unauthenticated actors, representing a severe risk to infrastructure hosting SGLang. The ability to run arbitrary Python code in the scheduler process compromises the integrity of the entire service. As Firewall Chronicle reported on 2026-10-13, similar command injection flaws in AI tooling like GPT-SoVITS have yielded high-severity ratings, highlighting the persistent risk in these ecosystems. The unauthenticated nature of the endpoint lowers the barrier for exploitation significantly.

Organizations using SGLang versions up to 0.5.22 are exposed if they have enabled the dumper server. The reliance on environment variables for activation means that configurations enabling debugging or monitoring features may inadvertently open this attack surface. The source material does not state whether a patch or fix has been released for these affected versions.

What to watch

• Monitor for unexpected Python processes spawned by the SGLang scheduler service.
• Check network logs for requests to the /dumper/configure endpoint from unknown IP addresses.
• Verify that the DUMPER_SERVER_PORT environment variable is not set in production environments.
• Review scheduler logs for anomalies during forward pass operations that indicate code execution.

Signals worth monitoring

Security teams should prioritize monitoring for anomalous process creation within the SGLang scheduler container or host. Look for outbound connections from the scheduler process that do not match expected baseline behavior, as this may indicate data exfiltration or command-and-control communication. Analyze web server access logs for requests to the /dumper/configure endpoint, particularly from new or untrusted source IPs. Check for unusual resource consumption spikes in the scheduler process, which could signal the execution of heavy or malicious Python scripts. Teams usually correlate these signals with firewall alerts to identify active exploitation attempts quickly.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: SGLang

• Disable the DUMPER_SERVER_PORT environment variable in all production and staging environments to prevent the endpoint from activating.
• Implement network-level access controls to block external traffic to the /dumper/configure endpoint, restricting it to localhost or trusted management IPs only.
• Monitor system processes for unauthorized Python interpreters running under the SGLang user context and alert on any deviations from standard operation.
• Review application logs for any instances of re.search or eval calls that originate from external inputs to identify potential sandbox escape attempts.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which SGLang versions are affected by CVE-2026-111391?

The vulnerability affects SGLang versions 0.5.10 through 0.5.22.

Is authentication required to exploit this vulnerability?

No, the /dumper/configure endpoint is unauthenticated, allowing remote attackers to exploit it without credentials.

What is the CVSS severity rating for this flaw?

The National Vulnerability Database rates CVE-2026-111391 as critical with a CVSS score of 9.2.