Mingkai Yu

SGLang with the Mooncake disaggregation backend allows denial of service when it accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket. Network-adjacent attackers can exhaust Prefill memory, leading to the scheduler being OOM-killed (Out-Of-Memory killed, a process where the operating system terminates a process to free up memory), by sending numerous registrations containing large nested-buffer frames and unique `mooncake session id` values.

In prefill/decode disaggregation mode, a server-side request forgery issue exists that allows unauthenticated attackers to trigger outbound requests. By sending crafted requests to the '/generate' endpoint of the Decode worker, attackers can use the `bootstrap host` and `bootstrap port` fields to probe internal hosts and ports. This action can block the shared scheduler loop, resulting in delays for other inference requests.

An uncontrolled memory allocation issue exists in the Mooncake disaggregation backend within the `handle staging rsp()` function. Unauthenticated network-adjacent attackers can exhaust Prefill memory by obtaining the rank address from the '/route' endpoint and sending STAGING RSP messages containing excessively large `chunk idx` values under new room IDs. This action can lead to the scheduler being OOM-killed, which refers to an Out-Of-Memory state where the operating system terminates the process to reclaim memory.

A denial of service issue exists where API clients can abort in-flight generation requests belonging to other users. This occurs when an attacker submits streaming requests to the '/generate' endpoint using a short, client-controlled `rid` (request identifier). By using single hex character `rid` values and then disconnecting, the attacker triggers prefix-matching abort logic that terminates all other active client requests.

An authorization bypass exists where holders of the data-plane API key can access mesh High Availability (HA) management routes. This occurs because the `/ha/*` endpoints skip control-plane Admin role checks. An attacker can read cluster topology, write gossiped configuration, modify global rate limits, and use the `POST /ha/shutdown` endpoint to silently dissolve HA coordination.

The software trusts caller-supplied `mm hashes` values as the multimodal prefix-cache key. This allows remote attackers to poison cached KV (Key-Value) entries across requests. By sending a different image under a known or predicted hash via the '/generate' endpoint, an attacker can disclose the image content of another request or corrupt the responses received by victims.

An unauthenticated attacker can cause a denial of service by sending a request to the '/generate' endpoint containing the `pd kv trans params` field. This triggers a failure in the `pickle.loads` function within `InferSamplingParams`, which crashes the inference thread. While the '/health' endpoint remains operational, all subsequent requests will hang until the system is restarted.

The multiprocess mode HTTP server lacks authentication, allowing remote unauthenticated attackers to access management endpoints that listen on all interfaces by default. This allows attackers to read environment credentials via the 'GET /env' endpoint and configuration via the 'GET /config' endpoint. Additionally, attackers can clear caches, delete cache objects, and modify tenant quotas to evict cached data belonging to other tenants.

An unauthenticated remote code execution issue exists where remote attackers can execute Python code by sending scripts to the '/run script' endpoint. By leveraging the injected FastAPI app object, attackers can recover real builtins to bypass the guarded ` import ` function, allowing them to import the `os` module and execute operating system commands with the privileges of the LMCache process.

The frontend monitoring service contains a server-side request forgery (SSRF) issue. Unauthenticated attackers can bypass the proxy allowlist by registering arbitrary hosts through the 'POST /api/proxies' endpoint. Subsequently, the '/proxy' or '/proxy2' endpoints can be used to access internal hosts, read responses, tamper with nodes, or stop the heartbeat.

The multiprocess coordinator lacks authentication, allowing remote unauthenticated attackers to access the HTTP fleet control API, which listens on all interfaces by default. Attackers can use the '/instances' endpoint to register or deregister instances, the '/quota' endpoint to overwrite quotas, and the '/events' endpoint to inject events. Additionally, they can enumerate '/directory/keys' to disclose placement metadata and disrupt caching.

A missing authentication issue allows unauthenticated attackers to force-delete objects via the `coro rpc` port. By sending forged requests with the `force` flag set, attackers can bypass lease checks and utilize the `Remove()`, `RemoveByRegex()`, `RemoveAll()`, and `BatchRemove()` functions to wipe keys matching any regex or clear the entire store, resulting in cache loss and request failures.

The Store REST service binds to 0.0.0.0 without authentication on any route. This allows unauthenticated attackers to access the following API endpoints: '/api/get', '/api/put', '/api/remove all', and '/api/mount'. Through these endpoints, an attacker can read cached KV (Key-Value) data, inject or delete objects, and mount segments described by the attacker.

A missing authorization issue allows unauthenticated attackers to manipulate replication tasks via the `coro rpc` port. By using victim client UUIDs obtained through the `QueryTask()` function, attackers can invoke `CreateCopyTask()`, `CreateMoveTask()`, `FetchTasks()`, and `MarkTaskToComplete()` to hijack task queues and falsely record replication activities.

A missing authorization issue allows unauthenticated attackers to inject completed LOCAL DISK replicas via the `NotifyOffloadSuccess` RPC. By mounting a local disk segment with a self-chosen client UUID, an attacker can attach replicas that point to endpoints under their control. This enables the delivery of poisoned disk-tier reads and the simulation of fake key existence.

A missing authorization issue allows unauthenticated attackers to erase disk replicas of any object. By accessing the `coro rpc` master port, an attacker can trigger the `EvictDiskReplica()` and `BatchEvictDiskReplica()` functions to evict DISK replicas across all tenants. This can result in the permanent deletion of objects if the disk replica was the only remaining copy.

An out-of-bounds read occurs in the `readString()` function within include/common.h. This allows unauthenticated attackers to crash the service, such as an SGLang inference server, by connecting to the handshake port and sending a zero-length handshake frame consisting of eight bytes.

The HTTP metadata server contains a missing authentication flaw in the '/metadata' endpoint. This allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Exploitation can lead to the poisoning of segment descriptors, such as `tcp data port`, or the re-creation of `rpc meta` entries to redirect KV cache transfers to listeners controlled by the attacker. Additionally, this issue can be used to exhaust server memory.

An untrusted pointer dereference exists in the `readHeader` function of `ServerSession`. This allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. By sending a crafted `SessionHeader` containing arbitrary `addr` and `size` values using READ or WRITE opcodes, an attacker can disclose KV cache contents, prompts, and secrets, or corrupt memory to achieve code execution.

An unauthenticated attacker can cause memory exhaustion by sending repeated notify frames, each up to 1 MB, to the handshake RPC port. This process fills the uncapped `notifys` vector within the `TransferMetadata::receivePeerNotify()` function, leading to unlimited process memory growth until the out-of-memory killer terminates the engine.