EUVD-2026-52815
GHSA-cw8w-568w-v2v5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Agrees with vendor-reported vector: network reachable, high complexity due to race timing, no privileges needed, high availability impact from potential service crash.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to data tampering and denial of service.
AnalysisAI
Race condition in NVIDIA Dynamo's LoRA manager singleton initialization exposes Linux-based AI inference deployments running versions up to v1.2.0 to data tampering and denial of service. The flaw, classified under CWE-362, arises during concurrent initialization of the singleton responsible for managing Low-Rank Adaptation (LoRA) adapters, allowing competing threads or network-triggered requests to corrupt shared state before synchronization is established. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the network-accessible attack vector paired with no privilege requirement makes this relevant for any internet-facing or multi-tenant Dynamo deployment.
Technical ContextAI
NVIDIA Dynamo (CPE: cpe:2.3:a:nvidia:dynamo:*:*:*:*:*:*:*:*) is an open-source distributed AI inference framework designed for serving large language models at scale on Linux. The vulnerability resides in the LoRA (Low-Rank Adaptation) manager component, which uses the singleton design pattern for initialization. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) describes a class of flaws where two or more concurrent execution threads race to access or modify shared state without adequate locking, leading to undefined behavior depending on scheduling order. In this case, the singleton initialization routine lacks sufficient synchronization primitives, allowing multiple concurrent callers - potentially triggered by simultaneous inference requests - to enter the initialization path simultaneously, causing partial or inconsistent state to be exposed to subsequent operations. The CVSS vector AV:N/AC:H reflects that exploitation is network-reachable but requires precise timing to win the race, consistent with classic TOCTOU (Time of Check to Time of Use) exploitation patterns.
RemediationAI
Upgrade NVIDIA Dynamo to a version beyond v1.2.0; the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5842 should be consulted for the exact patched release version, as an independently confirmed specific fix version is not present in the source data. If an immediate upgrade is not feasible, limit concurrent access to the Dynamo inference endpoint during startup and initialization phases - for example, by placing a load balancer or API gateway in front of the service configured to queue or hold requests until the service reports healthy, reducing the concurrency window during LoRA manager singleton initialization. Additionally, restrict network exposure of the Dynamo service to trusted internal networks or authenticated proxies to reduce the pool of potential concurrent initiators, noting this does not eliminate the race but reduces attack surface. Monitor for unexpected service crashes or inference errors at startup as indicators of exploitation attempts.
Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attacker
Deserialization of untrusted data in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) exposes unauthenticated remote
Out-of-bounds write in NVIDIA Dynamo for Linux enables remote unauthenticated attackers to cause denial of service or ta
Remote code execution, data tampering, denial of service, and information disclosure are possible through vulnerabilitie
Path traversal in NVIDIA Dynamo's image loading component on Linux enables unauthenticated remote attackers to read arbi
Hash collision exploitation in NVIDIA Dynamo's multimodal embedding cache on Linux allows unauthenticated remote attacke
Server-side request forgery in NVIDIA Dynamo's Rust multimodal media fetcher (Linux, versions through v1.1.0) allows una
Server-side request forgery via DNS rebinding in NVIDIA Dynamo's multimodal media fetcher exposes internal network resou
Server-side request forgery in NVIDIA Dynamo's multimodal media fetcher (Linux, versions through v1.1.0) allows unauthen
Server-side request forgery in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attac
Server-side request forgery in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) enables unauthenticated remote attack
Server-side request forgery in NVIDIA Dynamo for Linux (versions through v1.1.0) allows unauthenticated remote attackers
Same weakness CWE-362 – Race Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today