Low severity · published Jun 1, 2026
CVE-2026-10300
SGLang Inference HTTP Endpoint lora_manager.py assertion
3.7
CVSS
0.4%
EPSS
No
On KEV
Description
A security vulnerability has been detected in SGLang 0.5.10.post1. Impacted is an unknown function of the file python/sglang/srt/lora/lora_manager.py of the component Inference HTTP Endpoint. Such manipulation of the argument lora_path leads to reachable assertion. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
SGLang · Sglang
0.5.10.post1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10300
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10300
github.com
https://github.com/sgl-project/sglang/issues/23141
github.com
https://github.com/sgl-project/sglang/pull/25078
vuldb.com
https://vuldb.com/cve/CVE-2026-10300
vuldb.com
https://vuldb.com/submit/828086
vuldb.com
https://vuldb.com/vuln/367593
vuldb.com
https://vuldb.com/vuln/367593/cti
More from SGLang
9.8
CVE-2026-93034
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in…
9.8
CVE-2026-93088
No description published yet
9.8
CVE-2026-86793
No description published yet
9.8
CVE-2026-15969
No description published yet
9.8
CVE-2026-15976
No description published yet
