NVIDIA TensorRT-LLM: server-side request forgery lets a local user make the serving process issue arbitrary requests

Impact

TensorRT-LLM can be made to issue attacker-directed requests from the serving process, leading to information disclosure and, for one of the two ids, data tampering. The CVSS vector is local-access with changed scope and no privileges required, so the attacker starts with access to the machine or container running the server and ends up reaching things only the server can reach - cluster-internal endpoints, the cloud instance metadata service, model and weight stores, and control-plane APIs that trust in-cluster callers. On a shared inference node that is a tenant-to-infrastructure pivot: the inference server usually holds a service account and network position far better than the workload that calls it. NVIDIA split this across two ids under one advisory (bulletin 2026/5883), both rated 7.1 with the same vector and the same fix; the second is CVE-2026-65120, which the record describes as information disclosure only.

Who can reach it

Local: a user or process with access to the host or container running TensorRT-LLM, or able to submit input that the server fetches. The vector states no privileges and no user interaction are required once that local access exists; it is not reachable from the network by itself.

What to do

Upgrade TensorRT-LLM to the fixed version listed in NVIDIA bulletin 2026/5883 and restart the serving processes - for most fleets that is a rolling restart of the inference deployment, not a node reboot. The NVD record does not name the fixed version, so take it from the bulletin. While waiting, treat egress from inference pods as untrusted: block access to the instance metadata endpoint, and deny pod egress to cluster-internal control-plane and storage endpoints the model server does not need.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• vLLM (`MediaConnector`): SSRF, recurrence of CVE-2025-6242CVE-2026-24779 · vLLM (`MediaConnector`)High
• vLLM (`load_from_url_async`): Bypass of the CVE-2026-24779 SSRF fixCVE-2026-25960 · vLLM (`load_from_url_async`)High
• LangSmith SDK: pulling a public Hub prompt deserializes attacker-controlled LangChain objectsCVE-2026-45134 · LangSmith SDK (pull_prompt / pullPrompt manifest deserialization)High
• picklescan: `scan_pytorch` bypass via forged magic numbersCVE-2026-53875 · picklescanHigh
• NVIDIA Megatron-LM: hash collisions in the inference cache let one request's data reach anotherCVE-2026-65104 · NVIDIA Megatron-LM (inference request cache)High
• torchvision (GIF decoder): Out-of-bounds heap read in `read_from_tensor` GIF decodeCVE-2026-65918 · torchvision (GIF decoder)High