SGLang CVE-2026-93088 Exposes Unauthenticated Pickle RCE on Diffusion ZMQ

CVE-2026-93088 entered public trackers on September 22, 2026 as a critical unauthenticated remote code execution issue in SGLang’s multimodal generation runtime, specifically the disaggregated-diffusion orchestrator’s DiffusionServer. OpenCVE and the MITRE-facing record assign a CVSS 3.1 score of 9.8 and credit CERT/CC as assigner. Researcher Keita Sode (SYZD Research) published a detailed September 22 writeup describing how a network-reachable ZeroMQ ROUTER socket accepts multipart messages and passes the final frame directly to Python’s pickle.loads() before authentication or payload validation—classic unsafe deserialization with full process compromise when the socket is exposed.

SGLang is a widely used open serving stack for large language and multimodal models. Its multimodal generation path coordinates encoder, denoiser, and decoder workers for image and video pipelines. The vulnerable orchestrator arrived with the disaggregated diffusion feature (PR #21701 / commit 9da998a8 on April 16, 2026, per the writeup). Sode reports the sink present from the first affected release v0.5.11 through at least v0.5.20 and current main at the time of the September 22 article, with OpenCVE’s enrichment table currently listing an affected window of 0.5.11 through 0.5.14 pending vendor version updates.

How the sink reaches the network

According to the researcher’s trace, launching disaggregated mode with --disagg-role server constructs a frontend ZeroMQ endpoint from --host and --scheduler-port. The DiffusionServer event loop binds a ROUTER socket at that endpoint without ZeroMQ CURVE, ZAP, or an application-level handshake. On inbound multipart traffic, _handle_client_request takes the last frame and deserializes it with bare pickle.loads. Because pickle can invoke arbitrary callables during unpickling, a peer that can deliver a crafted multipart message can execute code as the serving process.

Two operational details amplify risk. First, when operators omit --host, the frontend may bind to 127.0.0.1, limiting exposure to local processes—but SGLang’s own disaggregation documentation, as cited by Sode, recommends --host 0.0.0.0 for single- and multi-machine guides, which exposes the unauthenticated socket on all interfaces. Second, the CLI help text describes --host as the HTTP API bind address even though the same flag also controls internal ZeroMQ binds, so teams following docs for HTTP reachability may not realize they opened a pickle IPC front door.

Sode’s validation used a non-destructive gadget that only printed a marker inside the process—no shell spawn, no file write, no outbound network—against an environment including sglang==0.5.17. Live socket inspection showed CURVE and PLAIN server flags off and an empty ZAP domain.

Related surfaces called out in the same audit

The September 22 article is not only the DiffusionServer CVE. After the initial finding, the researcher reports additional verified issues across the disaggregated fabric: encoder workers that hardcode 0.0.0.0 binds for work PULL sockets and also call pickle.loads on inbound frames; residual bare pickle paths in the monolithic scheduler corresponding to earlier CVE-2026-7301; unauthenticated JSON control channels with attribute injection risks; an unauthenticated multimodal HTTP surface lacking the srt runtime’s API-key options; path-traversal file writes on multipart uploads; and NumPy object-array deserialization via realtime WebSocket msgpack fields. Separately, multi-node srt configurations with --enable-dp-attention are described as binding pickle-based IPC over TCP when SGLang_USE_PICKLE_IPC defaults to true. Those extras are researcher findings accompanying the CVE narrative; operators should track upstream advisories for which items receive formal CVE IDs and patches.

Context matters: CERT/CC had already catalogued earlier SGLang ZeroMQ pickle RCEs (CVE-2026-3059, CVE-2026-3060, and related cases) fixed around the 0.5.10 line. The diffusion orchestrator reintroduced a bare pickle.loads sink weeks later in a new file, which is why this is described as a recurrence of the same class rather than a novel bug family.

What operators should do while waiting on a fix

As of the researcher’s September 22 writeup and OpenCVE’s same-day enrichment, no fixed upstream version is identified for CVE-2026-93088. Recommended interim controls from the disclosure: keep scheduler and related ZeroMQ ports off untrusted networks; prefer localhost binds where multi-node diffusion is not required; apply network ACLs between worker nodes; prefer safe serialization (JSON/msgpack with validation) or at least SGLang’s existing safe_pickle_loads helper wherever maintainers have it; and watch the sgl-project/sglang repository plus CERT/CC case VU#727584 / GitHub advisory GHSA-8374-wrr5-7q7f for a patch. Treat any DiffusionServer that was reachable with authentication disabled as potentially compromised for credential and model-path hygiene purposes.

Timeline anchors from the writeup: private GitHub report on July 3, 2026; CERT/CC VINCE case opened August 14; CVE assigned September 17; public CVE records and the technical article landing September 22. Until maintainers ship a replacement for the ROUTER pickle path, assume disaggregated multimodal deployments need network isolation first and version upgrades second.