Unauthenticated Routing Table Poisoning in SGLang

SGLang versions through 0.5.19 are vulnerable to a critical routing table poisoning flaw when operating in prefill/decode disaggregation mode. The prefill bootstrap service exposes an unauthenticated PUT /route endpoint, which lacks access controls, allowing unauthorized actors to inject arbitrary 'rank_ip' and 'rank_port' values into the internal KV transfer routing table. By manipulating this table, attackers can redirect traffic destined for decode workers to attacker-controlled infrastructure. Successful exploitation results in a denial-of-service condition for the affected model pipeline and the exfiltration of sensitive KV transfer metadata, including session identifiers and internal tensor-parallel topology parameters. This vulnerability is particularly impactful for distributed inference deployments relying on the disaggregated architecture of SGLang.

Impact

Successful exploitation enables attackers to intercept or disrupt model inference traffic. This can lead to the unauthorized disclosure of proprietary session metadata and internal topology information, as well as a complete denial of service for the disaggregated model inference cluster. The impact affects any organization utilizing SGLang in the specified disaggregation configuration.

Recommendation

• Immediately upgrade SGLang to a version beyond 0.5.19 to address the unauthorized access to the routing configuration.
• Implement network-level access control lists (ACLs) to restrict access to the SGLang prefill bootstrap service ports to known-trusted internal management IPs only.
• Audit web access logs for PUT requests directed to the /route endpoint that originate from untrusted or external network segments.
• Monitor for unexpected network connections from decode worker nodes to unknown or unauthorized destination IP addresses.