Unrated severityNVD Advisory· Published Jul 30, 2026· Updated Jul 31, 2026

CVE-2026-15969

Description

SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Sgl Project/Sglangllm-fuzzy

Patches

Vulnerability mechanics

References

github.com/sgl-project/sglang/security/advisories/GHSA-2wvm-gjg7-5jfmmitre
thoughts.apoorvdayal.com/posts/sglang-disclosures/mitre

News mentions

⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
The Hacker News · Aug 3, 2026

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000