EUVD-2026-44461
GHSA-jqmh-73hw-j5fm
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Description explicitly states network-accessible attacker, overriding AV:L; SSRF with scope change to internal services justifies S:C and PR:N.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA TensorRT-LLM for Linux contains a vulnerability in the multimodal media fetching functions, where a network-accessible attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to denial of service and information disclosure.
AnalysisAI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting via the multimodal media fetching subsystem. Versions up to and including v1.3.0 rc16 are affected, allowing a network-accessible attacker to coerce the server into issuing arbitrary outbound HTTP requests to internal or external targets, leading to information disclosure and denial of service. No public exploit code exists and CISA has not listed this in the KEV catalog; EPSS probability sits at 0.11% (2nd percentile), indicating very low observed exploitation pressure at time of analysis.
Technical ContextAI
TensorRT-LLM (CPE: cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:*) is NVIDIA's open-source library for optimizing and serving large language models on GPU hardware, typically deployed in enterprise AI inference pipelines on Linux. The vulnerability resides in multimodal media fetching functions - code paths that accept URLs pointing to image, audio, or video inputs and retrieve remote content on behalf of the model. CWE-918 (Server-Side Request Forgery) describes the root cause: user-controlled URL input is passed to an internal HTTP client without sufficient validation or allowlist enforcement, enabling the server process to be weaponized as an HTTP proxy. The CVSS-provided attack vector is AV:L (local), but the vendor description explicitly states 'network-accessible attacker,' creating a direct conflict that likely reflects the dual nature of the product: the inference API may be locally scoped in default deployments, yet can be exposed over a network in production clusters. The scope change marker (S:C) in the CVSS vector correctly captures the SSRF behavior - the attacker influences network resources beyond the initially targeted system.
RemediationAI
Upgrade TensorRT-LLM beyond v1.3.0 rc16 once NVIDIA releases a patched stable version; no exact fixed release version is confirmed in the available data, so monitor the NVIDIA Security Bulletin portal and the official TensorRT-LLM GitHub repository for a tagged release addressing CVE-2026-24234. As a compensating control, restrict the network reachability of TensorRT-LLM inference API endpoints using host-based firewall rules or network segmentation, limiting inbound access to trusted clients only - this reduces the exposed attack surface but does not eliminate the underlying SSRF flaw. Additionally, implement egress filtering on servers running TensorRT-LLM to block outbound HTTP/HTTPS traffic to internal RFC-1918 ranges and cloud metadata endpoints (e.g., 169.254.169.254), which limits the blast radius of a successful SSRF to only reachable external hosts. If multimodal URL input is not operationally required, disabling or restricting the multimodal media fetching feature at the application configuration level eliminates the vulnerable code path entirely. Note that egress filtering may break legitimate multimodal workflows that fetch content from external sources and requires allowlisting known-good domains.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today