CVE-2026-24229

Deferred Deferred - Pending Action

NVIDIA TensorRT-LLM Cluster State Tampering Vulnerability

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: NVIDIA Corporation

Description

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by sending requests to the FastAPI server. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-24229

Affected Vendors & Products

Vendor	Product	Version / Range
nvidia	tensorrt-llm	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability in NVIDIA TensorRT-LLM for Linux allows an attacker to interact with the FastAPI server in the disaggregated orchestrator component. By sending crafted requests, they can read, modify, or delete the internal cluster state, potentially causing information disclosure, data tampering, or service disruption.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to sensitive data, corruption of critical system files, or disruption of services relying on TensorRT-LLM. Attackers might steal confidential information, alter system behavior, or cause outages affecting dependent applications.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or modification. GDPR may be breached if personal data is exposed or altered, while HIPAA could be violated if protected health information is compromised. Organizations must address this to maintain regulatory adherence.

Mitigation Strategies

Immediately restrict access to the FastAPI server port used by the disaggregated orchestrator component. Ensure the server is not exposed to untrusted networks or the internet. Update TensorRT-LLM to the latest patched version as soon as it is available from NVIDIA.

Hi! I’m here to help you understand CVE-2026-24229. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70