SGLang information responses expose API and admin keys

What happened

SGLang can include API and administrator keys in server-information responses. When both keys are configured, a caller with the normal API key can obtain the administrator key. An admin-only configuration can expose that key to an unauthenticated caller. The CVE was published on 5 October.

The CNA scores this 3.7 Low under CVSS 3.1 and 6.3 Medium under CVSS 4.0; this row uses the former. The researcher’s report predates CVE publication. Fix proposal 30343 was closed without merging on 7 October. Its closure does not establish that an affected release was fixed.