EUVD-2026-44463
GHSA-vv3c-v9jv-69wx
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Local-only access path, high complexity, and high privilege align with a privileged runtime component where missing auth enables escalated impact within the same trust boundary.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
AnalysisAI
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a local attacker with high privileges to bypass internal authentication controls and trigger unauthorized execution of critical operations. Successful exploitation leads to code execution, data tampering, and information disclosure against the LLM inference runtime environment. No public exploit code has been identified and SSVC assessment confirms no known active exploitation, though the technical impact is rated total by CISA's decision framework.
Technical ContextAI
TensorRT-LLM is NVIDIA's high-performance inference optimization library for deploying large language models on CUDA-capable hardware under Linux. The root cause is CWE-306 (Missing Authentication for Critical Function), meaning one or more internal functions - likely related to the inference runtime, model management, or an inter-process communication channel - can be invoked without the authentication controls that should gate access to them. The affected CPE is cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:* covering all versions from 0.0 through v1.3.0 rc12. The local attack vector (AV:L) suggests the vulnerable function is exposed through a local socket, shared memory interface, or a privileged process API rather than a remotely accessible network service. The high privilege requirement (PR:H) in the CVSS vector is notable for a CWE-306 flaw and may indicate that a privileged process can remove or circumvent authentication for a downstream critical operation, escalating effective access within the inference runtime's trust boundary.
RemediationAI
Upgrade NVIDIA TensorRT-LLM to a version beyond v1.3.0 rc12; the affected version ceiling is v1.3.0 rc12, so any release candidate or stable release superseding this version should be evaluated against NVIDIA's release notes to confirm the fix is included. No direct NVIDIA security advisory URL is available in the provided data - monitor the NVIDIA Product Security page and the TensorRT-LLM GitHub releases for a patched stable release. As a compensating control while patching is pending, restrict local access to systems running TensorRT-LLM inference servers to only authorized, minimally privileged service accounts; audit which processes can interact with TensorRT-LLM's runtime interfaces and remove unnecessary access. Given AV:L/PR:H, tightening Linux DAC/MAC controls (e.g., SELinux or AppArmor profiles scoped to the inference process) can reduce the attacker's ability to reach the vulnerable function. These controls do not eliminate the vulnerability but reduce the realistic attacker pool.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Improper control of code generation in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allows a locally
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today