CVE-2026-111392: SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-16 · updated 2026-10-16
Weakness: CWE-345

Description

SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims' responses.

Affected products

SGLang: from 0.5.13 through 0.5.21

References

https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/managers/io_struct.py#L205-L215
https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/managers/tokenizer_manager.py#L1183-L1215
https://github.com/sgl-project/sglang/issues/44641
https://github.com/sgl-project/sglang/pull/44653
https://www.vulncheck.com/advisories/sglang-through-0.5.21-kv-cache-poisoning-via-mm-hashes-in-generate
https://github.com/sgl-project/sglang/issues/44641

Get alerted when CVE-2026-111392 or the next vulnerability affects your stack