Unpatched SGLang Vulnerabilities (CVE-2026-7301) Expose AI Inference Pipelines to RCE

CERT/CC disclosed three critical vulnerabilities in the SGLang multimodal AI serving framework: CVE-2026-7301 and CVE-2026-7304 enable unauthenticated remote code execution through insecure deserialization (pickle/dill), and CVE-2026-7302 permits unauthenticated path traversal during media uploads; the scheduler binds to 0.0.0.0 by default, no patch or maintainer response is available, and the advisory urges immediate mitigations (bind to loopback/private addresses, restrict network access, disable the custom logit processor).