EUVD-2026-44460
GHSA-6297-xg77-3cg9
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Concur with NVIDIA: AV:L since the FastAPI orchestrator is a local/internal control interface, PR:N/UI:N for missing authentication, high confidentiality from state read, low integrity/availability from tampering and DoS.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by sending requests to the FastAPI server. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
Articles & Coverage 1
AnalysisAI
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI server directly and read, write, or delete internal cluster state, resulting in information disclosure, data tampering, and denial of service. The flaw (CWE-306) affects the orchestration layer that coordinates disaggregated prefill/decode inference workers. No public exploit identified at time of analysis, and the CVSS 3.1 base score is 7.3 with a local attack vector despite the request-based nature of the issue.
Technical ContextAI
TensorRT-LLM is NVIDIA's library for optimizing and serving large language model inference on GPUs. Its disaggregated serving mode splits the inference pipeline (e.g., prefill and decode phases) across separate worker processes coordinated by an orchestrator that exposes a FastAPI (Python ASGI) HTTP control interface. The root cause is CWE-306 (Missing Authentication for a Critical Function): the orchestrator's FastAPI endpoints that manage internal cluster state accept requests without verifying caller identity, so any party able to reach the server can invoke state-changing operations. The affected component is identified by CPE cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:* covering the TensorRT-LLM application across versions.
RemediationAI
No vendor-released patch version was identified in the available data, so upgrade to the fixed NVIDIA TensorRT-LLM release once NVIDIA publishes it via its product security bulletin (start from the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-24229 and NVIDIA's advisory portal). As compensating controls in the interim: bind the disaggregated orchestrator's FastAPI server to localhost or a private management interface only rather than 0.0.0.0, and place it behind an authenticating reverse proxy or mutual-TLS gateway so unauthenticated state operations cannot be invoked directly; restrict network access to the orchestrator port using host firewall rules or Kubernetes NetworkPolicies so only trusted inference workers can reach it; and run TensorRT-LLM disaggregated serving on isolated, single-tenant nodes. The trade-off is that requiring authentication or proxying may add latency and configuration overhead to the orchestrator control path and could break worker-to-orchestrator communication if the trust boundaries are not configured to match your deployment.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today