NVIDIA Megatron Bridge: deserialization of untrusted data allows code execution in the training job

CVE-2026-61751AI/ML frameworks & servingcurated

Impact

A second deserialization flaw from the same NVIDIA bulletin: untrusted serialized data handled by Megatron Bridge can lead to code execution, data tampering, and information disclosure. Execution lands in the training process on a GPU node, with access to the attached GPUs, mounted checkpoint and dataset paths, and job credentials. The exposure that matters operationally is artifact supply - a checkpoint or conversion input shared between tenants or pulled from a model hub becomes a code-execution channel into the consuming job. NVIDIA's advisory does not break out which specific input each of the eight CVEs corresponds to.

Who can reach it

Local, low privileges required, no user interaction - anyone able to place or supply a serialized artifact that a Megatron Bridge process loads on the node.

What to do

Upgrade Megatron Bridge to 0.5.1; 0.0 through 0.5.0 are affected. Bump the package in training images, rebuild, and restart jobs to pick it up. No node drain or reboot needed. In the interim, restrict which serialized artifacts jobs are allowed to load to sources you control.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-61751 https://github.com/NVIDIA/product-security/tree/main/2026/5868 https://www.cve.org/CVERecord?id=CVE-2026-61751

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.