This CVE exposes SGLang's distributed serving architecture: when NCCL weight broadcasting is enabled (the default for multi-GPU serving), the communication layer accepts connections without any authentication. An unauthenticated attacker who can reach the NCCL port can trigger broadcast of all model weights across the cluster to themselves. The attack surface lives at the infrastructure layer, not the user-facing API—most developers won't even realize this pathway exists.
The root cause is the 'zero-config' default: API keys are optional to reduce friction for local testing and evaluation. But that choice degrades the entire security model to fully open when keys aren't configured—and NCCL broadcasting runs outside the API key boundary entirely. This isn't a novel exploit; it's the distributed systems variant of the same pattern that's produced exposed /metrics endpoints, open internal APIs behind load balancers, and permissive IAM on inter-service gRPC. The class is predictable: whenever frameworks ship with 'optional auth for ergonomics,' infrastructure-layer communication pathways become exploitable because nobody audited them as trust boundaries.
What makes this severe: model weights are strategic assets—months of training, RLHF feedback, and R&D investment. A single NCCL broadcast exfiltrates the entire model state. In ephemeral environments (spot instances, Kubernetes evaluation pods, short-lived GPU clusters), this reaches maximum blast radius: a pod serving weights across eight GPUs for forty minutes is indistinguishable from a persistent server to an attacker, but far more likely to be misconfigured since the 'we'll add auth before production' step often gets skipped.
Check your deployment now: identify every SGLang instance with distributed serving enabled, verify whether API keys are actually enforced on the NCCL communication path (not just the HTTP API), and assume any instance without explicit key configuration on the infrastructure layer has been exposed. The 7.5 CVSS reflects the severity of what's at stake; the low EPSS likely reflects the measurement blind spot around ephemeral compute rather than actual rarity—short-lived evaluation instances are exactly the deployments that evade network telemetry and never get counted.