NVIDIA TensorRT-LLM CVE-2026-65120

The available sources do not describe the specific feature, protocol, or configuration that triggers the SSRF - the trigger is not described in the available sources, so the exact prerequisite input path cannot be named. What is confirmed is that NVIDIA assigned AV:L, meaning exploitation requires access to a local input vector (an on-host interface, library invocation, or locally reachable API) rather than direct remote network access - this is the primary limiting factor and meaningfully constrains real-world exploitability versus a network-facing SSRF. PR:N indicates no authentication is required once that local vector is reached, and no user interaction is needed (UI:N). The only version identified as affected in the input is TensorRT-LLM 1.3.0rc24; applicability to other versions is not confirmed in the provided data.

This is a moderate-severity SSRF (CWE-918) in NVIDIA TensorRT-LLM, scored 7.1 by NVIDIA with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. The signals are mixed and some are notably absent. Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing, no EPSS score in the input, and the only references are the NVD/CVE.org records and NVIDIA's own product-security advisory page (an advisory, not exploit code). The vuln.today priority is 'this_week', indicating a near-term but not emergency remediation posture, consistent with the absence of KEV/active-exploitation signals. A significant internal tension exists in the data: the weakness class is SSRF, which is conventionally a network-reachable issue, yet NVIDIA (the reporter) assigned AV:L (local attack vector) - this strongly implies the attacker-controlled input reaches the server through a local interface, library call, or on-host API rather than over the open network; verify the exact exposure with NVIDIA's advisory. The scope change (S:C) with C:H/I:N/A:N correctly reflects SSRF's hallmark: no direct compromise of the vulnerable host, but confidential information from other reachable systems (e.g., internal services, cloud instance metadata) can be disclosed. Net assessment: a credible 'this_week' patch candidate for teams running the affected build, but the AV:L vector materially lowers real-world urgency versus a network-facing SSRF, and the lack of EPSS/KEV/PoC suggests no evidence of widespread or active exploitation.

An attacker with access to the local input vector of a TensorRT-LLM deployment supplies a crafted URL or endpoint reference that the server-side process fetches on their behalf. The forged request reaches an internal or otherwise non-public resource (such as a metadata service or internal API), and the response data is returned to or inferred by the attacker, yielding information disclosure. No public exploit code or working PoC is identified in the provided data, and the specific triggering input is not described in the available sources.