Unauthenticated deserialization in sglang /update_weights_from_tensor endpoint under active scanning (CVE-2025-10164)
Shadowserver's honeypot network recorded live exploitation attempts against this endpoint yesterday and today, so any sglang server reachable from untrusted networks can be hijacked before the next patch cycle.
The /update_weights_from_tensor API in sglang 0.4.6 deserializes the attacker-supplied serialized_named_tensors argument without authentication, allowing a remote attacker to trigger unsafe deserialization and execute code or corrupt the model server. A public exploit exists and the vendor has not responded to disclosure.
Affected: lmsys sglang 0.4.6
How to Test
Check whether your sglang server (default port 30000) is reachable from untrusted networks and whether POST /update_weights_from_tensor responds without authentication; grep access logs for POST requests to /update_weights_from_tensor from unknown source IPs as an indicator of exploitation attempts.
How to Mitigate
No vendor fix is confirmed for 0.4.6 and the vendor is unresponsive: immediately remove sglang from direct internet exposure, bind it to localhost or a private interface, require authentication via the --api-key startup flag, and firewall or reverse-proxy the /update_weights_from_tensor route so only trusted orchestration hosts can reach it.