NVIDIA Megatron Bridge: deserialization of untrusted data allows code execution in the training job

CVE-2026-61753AI/ML frameworks & servingcurated

Impact

Megatron Bridge deserializes untrusted data in a way that can lead to code execution, data tampering, and information disclosure. Because Megatron Bridge is loaded inside training jobs, successful exploitation gives an attacker the job's context on a GPU node: the devices it holds, the dataset and checkpoint volumes it mounts, and the secrets injected into it. The operational risk on a fleet is artifact-borne - a poisoned checkpoint or config moving between teams executes in the job that loads it. One of eight deserialization CVEs in NVIDIA bulletin 5868, all described identically.

Who can reach it

Local, low privileges required, no user interaction - anyone who can supply a serialized artifact that Megatron Bridge loads on the node.

What to do

Upgrade Megatron Bridge to 0.5.1; 0.0 through 0.5.0 are affected. Update the package in training images, rebuild, restart jobs. No node drain or reboot. Until rolled out, constrain job inputs to artifact sources you trust.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-61753 https://github.com/NVIDIA/product-security/tree/main/2026/5868 https://www.cve.org/CVERecord?id=CVE-2026-61753

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.