CVE-2026-105245

Name of the Vulnerable Software and Affected Versions sgl-project sglang versions prior to 0.5.22

Description A flaw in the HTTP Endpoint component allows remote attackers to cause the cleartext transmission of sensitive information. This occurs through the manipulation of the api key argument within the server info() function located in the python/sglang/srt/entrypoints/http server.py file.

Recommendations As a temporary workaround, restrict access to the server info() function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.