The inference engine is part of your attack surface. We treat it that way.
Open inference engines were built for speed of iteration, not for a vendor-risk questionnaire. Traction Runtime closes the gap between what upstream ships and what your security team can approve, publishes the checklist so they can verify it, and responds on the branch you actually run when the next issue lands.
The recurring classes
Open inference engines, SGLang included, have carried a steady run of remote-code-execution-class issues. None of this is a criticism of the maintainers; it is the normal history of fast-moving infrastructure software. The issues fall into a small number of classes that recur, which means the durable fix is a configuration you ship, not a patch you chase. Specific advisories, with status per branch, belong on the advisory tracker, not here.
| Class | How it shows up | What it means for a self-hosted deployment | In the hardened profile |
|---|---|---|---|
| Deserialization of untrusted data | Pickle-accepting endpoints and loading paths; "safe" unpicklers later bypassed | A network-reachable caller, or a model file, runs code as the serving process. Filtering the format is a race you eventually lose. | Pickle endpoints and code paths off, not filtered |
| Internal transports exposed to the network | ZeroMQ sockets between scheduler, tokenizer and workers bound to all interfaces | The engine assumed a trusted network. In an enterprise cluster that assumption is false. | ZeroMQ bound to localhost; multi-node on an authenticated mesh |
| Unauthenticated administrative routes | Routes that read or change engine state accept calls from anyone who can reach the port | Configuration changed, and state read, without identity or audit | API key and allow-listed caller on every admin route; append-only audit log |
| Template and input injection | Chat templates and other model-supplied content evaluated by the server | A model artifact becomes an execution vector; the fix waits on a maintainer | Templates loaded only from reviewed sources; our own mitigation carried when upstream has not responded |
| Pinned versions with no backports | Fixes land only on the newest upstream release | The version you qualified stays exposed until your next upgrade window | Backported to every supported LTS branch (Enhanced and Premium) |
The hardened profile
Shipped as the default in every Enhanced and Premium build, with a published checklist so your team verifies it rather than trusting it.
- 01
Pickle off.
Pickle-based endpoints and loading pathsare disabled in the build. There is no flag in the production image to turn them back on, because a flag is a policy and policies drift. - 02
Every admin route keyed.
Routes that read or change engine state require an
API key and an allow-listed caller, including the internal-state route that live tuning depends on. The tuner authenticates like anyone else, and every change is written to an append-only audit log with actor, old value, new value and reason. - 03
Internal transports off the network.
ZeroMQ sockets between scheduler, tokenizer and workers
bind to localhost. Multi-node transports are authenticated. Nothing listens on all interfaces by default. - 04
Non-root, minimal image.
Non-root user; Python dependencies pinned by hash; CUDA and driver versions declared in the release record; model artifacts verified against checksums you control before they reach GPU memory. - 05
No egress required.
Nothing in the subscription makes an
outbound connection. Licenses verify offline. Telemetry stays on your storage.
Vulnerability response
On the branch you run, not only on the newest release. Backports are included in Enhanced and Premium; our own patches when upstream is silent, and day-zero advisories, in Premium.
Backports.
When upstream publishes a fix, it is backported, built, signed and published on every supported LTS branch, so you do not re-qualify a new version to be patched.
Our own patches.
When upstream has not responded to a disclosed issue, we carry a targeted fix or mitigation, publish it with the advisory, and submit it upstream.
Day-zero advisories.
Every advisory states whether the hardened profile already closes the class, so your team knows its exposure before the patch lands. The patch is still taken; defense in depth means both.
Response commitments.
Fix and response targets are defined per package in the product data sheet and the subscription agreement.
Disclosure.
Coordinated disclosure with upstream SGLang and the wider ecosystem.
Signed, reproducible builds
You should be able to prove that what is running in your cluster is exactly what we built, from exactly the branch we say, before a single request is served.
Every Enhanced and Premium build ships with: container images and charts signed with Sigstore cosign, keyless, bound to our build identity; a software bill of materials covering the OS layer, CUDA libraries and the full Python environment; vulnerability-scan results with a disposition for every finding above medium; reproducibility from the public branch; and a human-readable release record.
You can enforce it with admission policies for Kubernetes and OpenShift that admit only images carrying our signature, mirror to your private registry with signatures intact, and pin a deployment to one LTS branch and refuse drift.
cosign verify \
--certificate-identity-regexp '[build identity URL pattern]' \
--certificate-oidc-issuer [OIDC issuer] \
[registry URL]/runtime/sglang:lts-1Governance continuity
Regulated buyers sometimes ask what happens to a community-hosted project if its governance changes. The practical answer is an independent long-term-support branch: whatever happens upstream, the branch you qualified keeps receiving fixes for its published lifetime, the build is reproducible from source, and source escrow is available on request. Continuity comes from the branch and the escrow, not from any project's org chart.
On compliance programs: the audit log and the tuner's action record are designed to map to the record-keeping expectations of NIST AI RMF, ISO/IEC 42001 and EU AI Act Article 12. That is alignment, not certification. Traction Layer AI does not hold SOC 2 or ISO/IEC 42001 certification today, and we will say so plainly here until we do.
Traction Layer AI aligns its controls and audit records to NIST AI RMF, ISO/IEC 42001 and EU AI Act Article 12. Alignment is not certification. Traction Layer AI does not hold SOC 2 or ISO/IEC 42001 certification today; both are on our certification roadmap.
Responsible disclosure
Report a vulnerability in Traction Runtime or any Traction Layer product to contactus@tractionlayer.ai. We acknowledge every report, coordinate disclosure with upstream where the issue originates there, and credit reporters who want credit. Please do not file security issues in public trackers.
Have your security team review it
We will walk your security architects through the hardened profile, the signing chain and the advisory process, and give them a build to verify themselves.