An unauthenticated routing table poisoning vulnerability in SGLang versions 0.5.19 and earlier poses a significant risk of denial of service and unauthorized metadata disclosure.

The prefill bootstrap service exposes an unauthenticated PUT /route endpoint that fails to validate input, allowing an unauthenticated attacker to manipulate KV transfer routing tables by supplying arbitrary IP and port values.

Successful exploitation of this vulnerability allows an attacker to redirect traffic to unauthorized endpoints, which can result in a complete denial of service for the affected worker nodes. Furthermore, this redirection facilitates the disclosure of sensitive KV transfer metadata, including session identifiers and tensor-parallel topology parameters, potentially exposing internal infrastructure details. Given the CVSS score of 8.6, this flaw is categorized as high severity and requires immediate attention to prevent system compromise.

Immediate Action: Update the SGLang installation to a patched version that addresses the insecure /route endpoint logic.

Proactive Monitoring: Review access logs for anomalous PUT requests directed at the prefill bootstrap service, specifically looking for unexpected IP addresses or port assignments in the routing configuration.

Compensating Controls: Implement network-level access control lists (ACLs) or a Web Application Firewall (WAF) to restrict access to the prefill bootstrap service to trusted internal IP addresses only.

Public Exploit Available: No

This vulnerability represents a critical risk to the availability and confidentiality of SGLang deployments using prefill/decode disaggregation mode. Administrators must prioritize applying the vendor-supplied security updates to eliminate the unauthenticated access vector. If immediate patching is not feasible, network segmentation remains the most effective method to mitigate the risk of unauthorized routing table manipulation.