CVE-2026-15974

Name of the Vulnerable Software and Affected Versions SGLang (affected versions not specified)

Description An SSRF (Server-Side Request Forgery) and local file read issue exists in the multimodal generation endpoint '/v1/chat/completions'. This occurs because the image url variable is not properly sanitized, which could allow an attacker to access internal metadata, secrets, and services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.