SGLang Hit With Unauthenticated Pickle RCE via /update_weights_from_tensor, the Fourth Critical Inference-Stack CVE in Four Weeks
CERT Coordination Center·high signal
CVE-2026-86793 lets an unauthenticated attacker reach SGLang's /update_weights_from_tensor endpoint when no auth keys are configured and execute code through pickle REDUCE; the SafeUnpickler policy is bypassable because builtins.__import__ and builtins.getattr remain resolvable. CERT/CC tracks it as VU#665416. Coverage credits VicOne researcher Reuel Magistrado and frames it as the fourth critical CVE in AI inference infrastructure in four weeks. Anyone self-hosting SGLang should assume the endpoint is reachable and firewall or disable it now.