CVE-2026-15978

Name of the Vulnerable Software and Affected Versions SGLang (affected versions not specified)

Description When no API keys are configured, the software exposes two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL (NVIDIA Collective Communications Library, a library for multi-GPU communication) and subsequently trigger data transfer to exfiltrate all model weights.

Recommendations Configure API keys to restrict access to the endpoints and prevent unauthorized data transfer.