CVE-2026-15977 CVE-2026-15977

High 7.5 Published 30 Jul 2026 Updated 31 Jul 2026

Attackers can retrieve API keys and SSL keyfile information from the /server_info endpoint when admin API key is configured.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-15977?

CVE-2026-15977 is a high-severity vulnerability in SGLang, published on 30 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured.

Weakness: CWE-522

Which versions are affected by CVE-2026-15977?

It affects 1 product.

Products include Lmsys Sglang.

How do I fix CVE-2026-15977?

No fix has been published for CVE-2026-15977 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-15977 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-15977 exists.

Sources

Also known as GHSA-jx7q-p32r-7wx8, GHSA-vwmc-327h-6x3j.