EUVD-2026-44460
GHSA-6297-xg77-3cg9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local/internal network access to host
-
DeliveryReach orchestrator FastAPI endpoint
-
ExploitSend unauthenticated state request
-
ExecutionRead, write, or delete cluster state
-
ImpactInformation disclosure, tampering, or DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that NVIDIA TensorRT-LLM be deployed in disaggregated serving mode with the orchestrator's FastAPI server running and reachable by the attacker; the specific enabling feature is the disaggregated orchestrator control interface, which exposes state-management endpoints without authentication (CWE-306). No credentials, privileges, or user interaction are needed once the server is reachable (PR:N/UI:N/AC:L). The key limiting factor is the AV:L (local) attack vector: the FastAPI server is evidently not intended to be exposed to untrusted networks, so an attacker must already have local host access or reachability on the trusted internal cluster network - deployments that keep the orchestrator bound to localhost or an isolated management network, or that do not use disaggregated serving, are not exposed. The network-versus-local discrepancy between the description and the CVSS vector should be confirmed against the vendor advisory. |
| Impact | The vendor-supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, score 7.3) rates this as a local, low-complexity, unauthenticated issue with high confidentiality impact and low integrity/availability impact. There is a notable tension: the description says an attacker exploits the flaw by 'sending requests to the FastAPI server,' which reads as a network interaction, yet NVIDIA scored it AV:L (local) - this strongly implies the FastAPI orchestrator is expected to bind to localhost or a trusted internal socket rather than be externally exposed, so exploitation assumes the attacker already has local/adjacent access to the host or cluster network. Verify the actual bind address and network exposure with NVIDIA's advisory before treating this as remotely reachable. EPSS is not provided, the CVE is not on CISA KEV, and no POC is referenced, so this is a moderate-priority hardening issue rather than an actively exploited emergency; prioritize it where TensorRT-LLM disaggregated serving runs on multi-tenant or shared infrastructure. |
| Exploit ScenarioDerived | An attacker with local access to a shared GPU inference host - for example a low-privileged tenant, a compromised sidecar, or a co-located process - sends crafted HTTP requests to the orchestrator's FastAPI endpoint and, because no authentication is enforced, reads internal cluster state to harvest sensitive data, tampers with routing/state entries, or deletes state to crash the serving pipeline. Given AC:L and PR:N this requires no special privileges or user interaction once the server is reachable, though the AV:L rating implies the attacker must first be positioned on the host or trusted internal network. No public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI server directly and read, write, or delete internal cluster state, resulting in information disclosure, data tampering, and denial of service. The flaw (CWE-306) affects the orchestration layer that coordinates disaggregated prefill/decode inference workers. No public exploit identified at time of analysis, and the CVSS 3.1 base score is 7.3 with a local attack vector despite the request-based nature of the issue.
RemediationAI
No vendor-released patch version was identified in the available data, so upgrade to the fixed NVIDIA TensorRT-LLM release once NVIDIA publishes it via its product security bulletin (start from the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-24229 and NVIDIA's advisory portal). As compensating controls in the interim: bind the disaggregated orchestrator's FastAPI server to localhost or a private management interface only rather than 0.0.0.0, and place it behind an authenticating reverse proxy or mutual-TLS gateway so unauthenticated state operations cannot be invoked directly; restrict network access to the orchestrator port using host firewall rules or Kubernetes NetworkPolicies so only trusted inference workers can reach it; and run TensorRT-LLM disaggregated serving on isolated, single-tenant nodes. The trade-off is that requiring authentication or proxying may add latency and configuration overhead to the orchestrator control path and could break worker-to-orchestrator communication if the trust boundaries are not configured to match your deployment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TensorRT-LLM is NVIDIA's library for optimizing and serving large language model inference on GPUs. Its disaggregated serving mode splits the inference pipeline (e.g., prefill and decode phases) across separate worker processes coordinated by an orchestrator that exposes a FastAPI (Python ASGI) HTTP control interface. The root cause is CWE-306 (Missing Authentication for a Critical Function): the orchestrator's FastAPI endpoints that manage internal cluster state accept requests without verifying caller identity, so any party able to reach the server can invoke state-changing operations. The affected component is identified by CPE cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:* covering the TensorRT-LLM application across versions.
Know when Tensorrt Llm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Concur with NVIDIA: AV:L since the FastAPI orchestrator is a local/internal control interface, PR:N/UI:N for missing authentication, high confidentiality from state read, low integrity/availability from tampering and DoS.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by sending requests to the FastAPI server. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
Articles & Coverage 1
Executive ViewAI
NVIDIA TensorRT-LLM for Linux contains unauthenticated access to its disaggregated inference orchestrator component, enabling attackers to read, modify, or delete cluster state without credentials. Organizations deploying this software for AI inference operations face direct exposure of model data, inference metadata, and risk of service outage through malicious manipulation of the orchestration layer.
Implement network-layer access controls (firewall, VPC security groups) restricting orchestrator FastAPI endpoints to whitelisted administrative IPs only; deploy a reverse proxy or API gateway with authentication in front of the FastAPI service; establish continuous monitoring and alerting for unauthorized access attempts to orchestrator endpoints; consider air-gapped or private network deployment until vendor-released patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
TensorRT-LLM 1.3.0rc24 can load a tokenizer from an attacker-influenced location during KvCacheAwareRouter initializatio
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Server-side request forgery (SSRF) in NVIDIA TensorRT-LLM 1.3.0rc24 allows an attacker who can reach a local input vecto
Server-side request forgery (CWE-918) in NVIDIA TensorRT-LLM, reported by NVIDIA at CVSS 7.1, allows an attacker positio
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Exploit-DB