# SGLang: a caller-set hash makes the cache serve another request's image

> CVE-2026-111392 lets a remote caller of SGLang's /generate endpoint reuse another request's cached image by declaring its hash.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** SGLang
- **Disclosed:** 2026-10-16
- **CVE:** CVE-2026-111392
- **CVSS:** 6.3
- **Affects:** SGLang
- **Research by:** Mingkai Yu, Jiadai Wang, Jiajia Liu
- **Primary source:** https://github.com/sgl-project/sglang/issues/44641
- **Page:** https://theinjection.dev/items/sglang-mm-hashes-kv-cache-poisoning/

CVE-2026-111392 lets a caller of SGLang's native /generate endpoint choose the cache key for an image, so a crafted request can have another request's cached image served back to the model. No released version fixes it.

## What happened

VulnCheck published CVE-2026-111392 on October 16, 2026 and credits Mingkai Yu, Jiadai Wang and Jiajia Liu. A bug report filed in the SGLang repository the same day reports the flaw reproducing on three of three cold restarts, and a second client on another host receiving the first client's image content. A contributor opened a pull request against the report the same day.

## How it works

SGLang's native /generate endpoint accepts an mm_hashes field: one hex string per image, chosen by the caller. The reporter traced how that value is written straight onto the multimodal item, skipping the content-based hash recompute, and then becomes the item's pad value filling the image region of the token sequence. The declared hash therefore becomes the prefix cache's identity for that image, so a request carrying one image under a hash already used for a different image reuses the earlier image's cached KV entries. The model then describes the earlier image and returns an ordinary-looking completion, with no warning or error.

## Who is affected

Multimodal SGLang deployments that expose the native /generate endpoint to callers who are not fully trusted carry the risk, across the release range listed below. Deployments reached only through the OpenAI-compatible endpoints are out of scope, because those routes do not expose the mm_hashes field. The reporter's own test ran a Qwen2.5-VL-3B-Instruct server on a single GPU.

## What to do

Restrict access to SGLang's native /generate endpoint, or route callers you do not trust through the OpenAI-compatible endpoints instead, until a fixed release ships. Operators who need the native endpoint can track pull request 44653, which would ignore caller-declared hashes unless the server is started with a new opt-in flag.

## Quick facts

- **Affected:** SGLang 0.5.13 through 0.5.21
- **CVE:** CVE-2026-111392
- **CVSS:** 6.3 medium (VulnCheck, CVSS 4.0)
- **Attack type:** Prefix-cache poisoning through a caller-declared image hash
- **Fixed in:** No fixed release; pull request 44653 is open and unmerged
- **Found by:** Mingkai Yu, Jiadai Wang, Jiajia Liu
- **Disclosed:** October 16, 2026

## Questions

### Is there a patch for CVE-2026-111392 in SGLang?

No released SGLang version fixes CVE-2026-111392 as of October 16, 2026. A pull request, 44653, would ignore caller-declared mm_hashes unless an operator starts the server with a new --trust-caller-mm-hashes flag, but the pull request is still open and unmerged, and its author notes the end-to-end reproducer has not been run on a GPU. Restricting access to the native endpoint is the available mitigation.

### Which SGLang endpoints expose the mm_hashes field?

Only SGLang's native /generate endpoint accepts the mm_hashes field, according to the bug report. The OpenAI-compatible endpoints do not expose it, so deployments that serve traffic solely through those routes are not reachable by this attack. The reporter also notes that SGLang's Kimi embedding path already rejects caller-supplied mm_hashes, while the generic multimodal path does not.

### How does CVE-2026-111392 differ from the SGLang debug dumper flaw?

CVE-2026-111392 poisons the multimodal prefix cache and can disclose another request's image, while CVE-2026-111391 lets a caller run Python in the SGLang scheduler process through a debug endpoint. VulnCheck published advisories for both on October 16, 2026, but they sit in different code paths: the cache flaw is rated 6.3 medium and the debug dumper flaw is rated critical.

## Sources

1. [SGLang Issue 44641](https://github.com/sgl-project/sglang/issues/44641)
2. [VulnCheck Advisory](https://www.vulncheck.com/advisories/sglang-through-0.5.21-kv-cache-poisoning-via-mm-hashes-in-generate)
3. [Proposed Fix PR](https://github.com/sgl-project/sglang/pull/44653)