NVIDIA Megatron Bridge: deserialization of untrusted checkpoints or configs gives code execution

Impact

Megatron Bridge, the library that converts models and checkpoints between Hugging Face and Megatron-LM formats, deserializes untrusted data. Anything it loads - a checkpoint, a converted model or a config pulled from shared storage or a public hub - can execute arbitrary code as the process that loaded it. On a GPU fleet that means code inside a container that already holds the GPU devices, the dataset and checkpoint mounts, the writable shared filesystem and, on Kubernetes, the pod's service-account token, so the reach covers tampering with training data and emitted checkpoints as well as reading them. NVIDIA split this single flaw across 30 CVE ids in bulletin 2026/5868 (CVE-2026-61750 through CVE-2026-61779), all with the same 7.8 score, the same advisory and the same fix; this entry covers the whole set.

Who can reach it

Local, with low privileges required and no user interaction per the CVSS vector - in practice, anyone who can supply a serialized artifact (checkpoint, config, conversion input) that a Megatron Bridge process loads on the node.

What to do

Update Megatron Bridge to 0.5.1 - versions 0.0 through 0.5.0 are affected and NVIDIA lists no workaround. One bump closes all 30 ids. The library ships inside training images, so the work is pinning the fixed version, rebuilding or re-pulling the image, and restarting training, fine-tuning and conversion jobs plus any long-lived conversion service; running jobs keep the vulnerable copy until restarted. Until images are rebuilt, treat checkpoints and configs from shared or external sources as untrusted input.

Also covers 29 CVEs

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• NVIDIA NemoClaw: OS command injection in the status and logs plugin commandsCVE-2026-65089 · NVIDIA NemoClaw for Linux (status and logs plugin commands)High
• NVIDIA NemoClaw: OS command injection in the NIM management componentCVE-2026-65090 · NVIDIA NemoClaw for Linux (NIM management component)High
• NVIDIA NemoClaw: OS command injection in the Telegram bridge componentCVE-2026-65096 · NVIDIA NemoClaw for Linux (Telegram bridge component)High
• NVIDIA NemoClaw: OS command injection through the command-line interfaceCVE-2026-65099 · NVIDIA NemoClaw for Linux (command-line interface)High
• NVIDIA DeepStream: crafted tensor dimensions in a YAML config trigger an integer overflowCVE-2026-65102 · NVIDIA DeepStream (tensor dimension parsing from a YAML configuration file)High
• NVIDIA Megatron-LM: malicious checkpoint files execute code when loadedCVE-2026-65110 · NVIDIA Megatron-LM (checkpoint loading)High