SGLang’s /server_info endpoint returns stored API keys and SSL keyfile details when the service is configured with only the --admin-api-key. This credential leakage allows an attacker who can reach the endpoint to obtain secrets that grant administrative or programmatic access to SGLang, potentially leading to full compromise of the system and exfiltration of data. The flaw is a data‑exposure weakness that reveals sensitive information without proper authentication checks.

The affected product is SGLang, developed by SGLang. No specific product versions are listed in the advisory.

The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation at present. The CVSS score of 7.5 indicates a high severity. However, once the flaw is publicly known, an attacker could target the endpoint by sending an unauthenticated HTTP request, potentially retrieving the admin API key and SSL keyfile data. It is inferred that the endpoint is reachable over a network interface exposed to the attacker, either within a local network or via the public internet, and that no authentication is performed for the call. The risk remains until the issue is fixed.