CVE-2026-15977: Lmsys Sglang

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured.

Affected products

• Lmsys Sglang: up to and including 0.5.15

Published 2026-07-30. Last modified 2026-08-04.