Unpatched SGLang flaw allows unauthenticated remote code execution through a weight-update endpoint

A critical vulnerability disclosed on September 11 in SGLang, an open-source framework for serving large language models, allows unauthenticated remote code execution on the host running the inference process. Tracked as CVE-2026-86793 and discovered by VicOne researcher Reuel Magistrado, the flaw stems from a bypass of SGLang's SafeUnpickler policy. An overly broad allowlist for Python builtins, combined with an incomplete denylist, lets an attacker chain the import and getattr functions to reach arbitrary functions in any importable module. The vulnerable endpoint, which updates model weights from a tensor, is marked as admin-optional and accepts unauthenticated requests when no API key is configured. An attacker only needs to send an HTTP request to a reachable host, and successful exploitation grants the same privileges as the SGLang process. No vendor patch existed at the time of disclosure. The OpenCVE record lists no specific affected version numbers, so any instance running the vulnerable code path with the endpoint exposed and no keys set is considered at risk. No CVSS or EPSS score is available and the bug is not in the CISA Known Exploited Vulnerabilities catalog. Forkast frames the disclosure as the fourth critical CVE in an 18-day window across the AI stack, arguing that the authentication gap has migrated from agent runtimes into the inference server layer.