NVIDIA TensorRT-LLM CVE-2026-24269

The CVSS vector sets AV:L, so exploitation requires local or adjacent access to the system or service running TensorRT-LLM rather than remote internet reachability; PR:N and UI:N mean no authentication and no user interaction are needed once that access is obtained, and AC:L means no special timing or configuration hurdle is described. The exact feature, API endpoint, or input that triggers the server-side request is NOT described in the available sources (NVIDIA advisory 2026/5883, NVD, CVE.org). The primary limiting factor is the local/adjacent attack vector - an attacker must already be positioned on or beside the inference host, which materially narrows realistic exposure compared to a network-facing SSRF. Affected version per EUVD is TensorRT-LLM 1.3.0rc24.

This is a moderate-severity SSRF (CWE-918) in NVIDIA TensorRT-LLM, scored CVSS 7.1 by NVIDIA (the reporting vendor) with vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. The signals are mixed and partly conflicting. Notably, the CVSS vector specifies AV:L (local attack vector) even though SSRF is typically a network-reachable class - this suggests the attacker must already have local/adjacent access to the host or the inference service interface rather than reaching it from the open internet; this should be verified against the NVIDIA advisory. There is a second internal inconsistency: NVIDIA's vector sets I:N (no integrity impact), yet the description explicitly states the exploit 'might lead to information disclosure and data tampering' - data tampering implies an integrity impact, so the I:N rating and the description disagree and should be reconciled with the vendor. The vuln.today priority is 'this_week' (not act_now/emergency). KEV status is not present in the input, so this is NOT confirmed actively exploited. No EPSS score was provided, and no SSVC decision fields were supplied. The only references are NVD/CVE.org mirrors and the NVIDIA product-security advisory directory - none of these is a verified working exploit. On balance this is a real but non-emergency, this-week-priority issue: the low attack vector and the absence of confirmed exploitation lower urgency relative to the 7.1 base score, but the scope-change (S:C) and high confidentiality impact keep it above purely theoretical risk.

An attacker with local or adjacent access to a host running TensorRT-LLM submits input that coerces the server into making an attacker-controlled request to internal resources, retrieving data the attacker should not reach (information disclosure) and potentially altering data (per the description). No public exploit code was identified at the time of analysis; only the NVIDIA product-security advisory and NVD/CVE mirrors are referenced. Because the CVSS vector is AV:L/AC:L/PR:N, exploitation is low-complexity and needs no authentication but requires local/adjacent positioning rather than remote internet access.