CERT/CC reported three Python pickle deserialization RCE paths in SGLang: two required optional distributed features enabled and unauthenticated ZeroMQ ports reachable, while the third required an operator to replay a malicious request dump. Because public patch notes and current CNA disclosures disagree on fixed versions, defenders should verify runtime configuration and peer reachability instead of relying only on package version strings.
ASSESSED SYSTEM
A vulnerable SGLang deployment with an affected optional distributed feature enabled and an unauthenticated ZeroMQ listener reachable from an untrusted peer.
OUT OF SCOPE
The local request-dump replay path, deployments without the affected optional features, and configurations whose listeners are unreachable from untrusted networks.
Architecture: Standalone LLM / Generative AI (decision tree Q2) — The affected system is model-serving infrastructure; the exploit executes during internal message deserialization rather than through autonomous tool planning. Tier 1: Tier 1 because unauthenticated peer input could execute code in distributed AI-serving infrastructure.
Documented attack or failure path
- Pickle executes code during deserialization. An attacker-controlled payload reaches pickle.loads() or pickle.load() and executes before downstream logic can validate the data structure.
- Two network paths required specific configurations and exposure. CVE-2026-3059 affected the optional multimodal generation broker, and CVE-2026-3060 affected Encoder Parallel Disaggregation. Both required administrators to enable the feature and leave the unauthenticated ZeroMQ listener reachable from untrusted hosts.
- The third path required a local operator action. CVE-2026-3989 affected replay_request_dump.py . The attacker must control the dump file or trick an operator into replaying it; this is not an unauthenticated network RCE by itself.
- Public patch disclosures are inconsistent. CERT/CC and 0.5.10 release notes state the three CVEs are fixed in 0.5.10, but current CNA records still list 0.5.10 as vulnerable. Defenders should verify ZeromQ bind address, cross-node configuration, and reachability in addition to upgrading. There is currently no public evidence that these vulnerabilities have been used in actual attacks.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Two network paths required administrators to enable optional distributed features and make the listeners reachable; default configurations reduce exposure.
- The third path required an operator to replay a malicious dump and is excluded from this assessed boundary.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.09–0.74 (midpoint 0.41), Tier 1 MVT 0.60 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.35 | The 0.25 anchor: reachable structured input received limited transport handling but no safe parser or adversarial validation before code-executing deserialization. | Attacker-controlled ZeroMQ messages reached Python pickle deserialization on two optional distributed paths before downstream logic could validate the object.source: primary/brief |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 1 MVT 0.60 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 1 MVT 0.55 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 1 MVT 0.60 indeterminate | |||
| Containment (Cn) — scenario interval 0.04–0.57 (midpoint 0.30), Tier 1 MVT 0.65 confirmed breach | |||
| Cn-1Scope Enforcement | 0.25w 0.16 | The 0.25 anchor: optional feature and bind configuration constrained exposure, but effective network scope was not default-deny in the vulnerable condition. | Affected listeners could be exposed beyond required peers when cross-node features were enabled, allowing an untrusted host to reach an internal execution path.source: primary/brief |
| Cn-3Output Filtering Robustness | 0.00w 0.20 | The 0.00 anchor: the unsafe payload directly crossed the code-execution boundary with no effective fail-closed parser or execution gate. | pickle.loads() or pickle.load() executed attacker-controlled code before any downstream data validation could run.source: primary/brief |
| Cn-5Agent Identity Integrity | 0.00w 0.11 | The 0.00 anchor: no peer identity verification protected the affected execution channel. | The two network paths used unauthenticated ZeroMQ listeners; a reachable sender did not need a verified workload identity before supplying the serialized message.source: primary/brief |
Unknown, not N/A: 19 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.35 | Placed from the demonstrated decision and action authority of the assessed boundary; public evidence supports this bounded level but not a broader claim about current product defaults. |
| AsAttack Surface Exposure | 0.75w 0.25 | Placed from who can supply the initiating content or protocol message and from the trust status of that source in the documented configuration. |
| CpCascade Potential | 1.00w 0.25 | No verified System Dependency Graph with DGC at least 0.90 is public for this boundary, so the specification's worst-case graph default governs rather than an assessor-estimated blast radius.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.25w 0.15 | Placed from the documented remediation class: deterministic package/configuration change where available, otherwise provider, architecture, or multi-layer changes. It does not assert fleet-wide closure. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.35 | The public record identifies the affected product or representative configuration, attack path, and principal control boundaries, but does not provide a complete asset manifest, verified dependency graph, configuration export, or assessment evidence manifest. |
| Ec — Public evaluation coverage | 0.17 | coverage 0.17 (4 of 23 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.04 | Evidence dated 2026-03-31; age 135 days on the workpaper reference date. Components: T_calendar 0.04 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_calendar. Evidence age is measured from 2026-03-31 to the 2026-08-13 workpaper reference date. Public sources do not provide a passing containment or behavioral re-attestation receipt; event, monitoring, and unresolved-evidence caps remain diagnostic only. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.14 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleAIDEFEND dataVersion 2026.08.05. Inventory the running SGLang package version and image digest; if confirmed vulnerable, upgrade immediately to the supported release. If an immediate upgrade is delayed, temporarily disable affected optional features, rebuild on the fixed version, stage deployment, and verify older workloads have exited. Because public sources conflict on version 0.5.10, runtime config checks and peer connectivity tests are mandatory. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Very High | Ro-4 Tr-4 |
| AID-I-002.001 | Internal AI Network SegmentationAIDEFEND dataVersion 2026.08.05. Restrict ZeroMQ ports to required peer IPs with host firewalls and default-deny NetworkPolicy. This blocks untrusted network traffic before it reaches pickle deserialization, even if cross-node configuration overrides the loopback default. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Cn-4 |
| AID-H-004.002 | Service & API AuthenticationAIDEFEND dataVersion 2026.08.05. Enforce mTLS or workload identity for cross-host broker traffic to require caller authentication and scope access. This removes implicit trust from internal ports, though transport authentication cannot neutralize malicious data from a compromised peer. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | High | Cn-5 Tr-3 |
| AID-I-001.001 | Container-Based IsolationAIDEFEND dataVersion 2026.08.05. Run SGLang as non-root with a read-only filesystem, minimal mounts, no production secrets, and resource caps. If deserialization executes code, these boundaries limit file, identity, and lateral access, containing impact rather than fixing the parser. This relationship is an evidence route only and supplies no positive score credit without observed control operation. | Medium | Cn-7 Pr-2 |
WHAT THIS CASE TEACHES
An internal AI message bus is still an untrusted code boundary: peer identity, segmentation, and safe serialization must hold before bytes reach a deserializer.
Sources: AIDEFEND in Action — SGLang's ZMQ and Pickle Paths Show Why Internal AI Messages Need a Trust Boundary · Primary source — CERT/CC Vulnerability Note VU#665416: SGLang contains multiple deserialization vulnerabilities