NVIDIA Megatron Bridge: deserialization of untrusted data allows code execution in the training job

CVE-2026-61752AI/ML frameworks & servingcurated

Impact

Untrusted data deserialized by Megatron Bridge can lead to code execution, data tampering, and information disclosure. The code runs as the training job on a GPU node, inheriting its GPU access, storage mounts, and any tokens the job carries - so a compromise reaches training data and output checkpoints, not just the process. On a shared cluster the realistic path is a checkpoint or config artifact crossing a tenant or team boundary. Part of a set of eight identically-described deserialization CVEs fixed together; the advisory does not identify the individual input paths.

Who can reach it

Local, low privileges required, no user interaction - an attacker who can get a serialized artifact loaded by a Megatron Bridge process on the node.

What to do

Upgrade Megatron Bridge to 0.5.1; versions 0.0 through 0.5.0 are affected. Rebuild training images with the fixed package and restart jobs. No node drain, reboot, or firmware step. Meanwhile, treat externally-sourced checkpoints and conversion inputs as untrusted code.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-61752 https://github.com/NVIDIA/product-security/tree/main/2026/5868 https://www.cve.org/CVERecord?id=CVE-2026-61752

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.