NVIDIA Megatron Bridge: deserialization of untrusted data allows code execution in the training job

CVE-2026-61750AI/ML frameworks & servingcurated

Impact

Megatron Bridge deserializes untrusted data, and a successful exploit can lead to code execution, data tampering, and information disclosure. Megatron Bridge runs inside training jobs on GPU nodes, so the code executes with whatever the job holds - the GPU devices, the checkpoint and dataset mounts, and any credentials injected into the training pod. On a shared fleet the practical worry is a poisoned checkpoint or conversion input travelling between teams: whoever supplies the artifact gets execution in the consumer's job. This is one of eight deserialization CVEs NVIDIA fixed in the same bulletin; the advisory does not describe which input path each one covers.

Who can reach it

Local, with low privileges required and no user interaction per the CVSS vector - in practice, anyone who can supply a serialized artifact (checkpoint, config, conversion input) that a Megatron Bridge process loads on the node.

What to do

Upgrade Megatron Bridge to 0.5.1; versions 0.0 through 0.5.0 are affected. That means bumping the package in your training images, rebuilding, and restarting jobs - running jobs pick up the fix only on restart. No node drain, reboot, or firmware work is involved. Until the images are rebuilt, treat checkpoints and conversion inputs from outside your trust boundary as untrusted.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-61750 https://github.com/NVIDIA/product-security/tree/main/2026/5868 https://www.cve.org/CVERecord?id=CVE-2026-61750

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.