NVIDIA Megatron Bridge: deserialization of untrusted data allows code execution in the training job

CVE-2026-61755AI/ML frameworks & servingcurated

Impact

Untrusted data deserialized by Megatron Bridge can result in code execution, data tampering, and information disclosure. Execution occurs in the training process on a GPU node, so the attacker gains the job's GPU access, its storage mounts, and any credentials handed to it - enough to tamper with training data or emitted checkpoints as well as read them. The practical exposure on a shared cluster is a serialized artifact crossing a trust boundary. This is one of eight deserialization issues NVIDIA fixed in a single bulletin without distinguishing the affected code paths.

Who can reach it

Local, low privileges required, no user interaction - anyone who can get a serialized artifact loaded by Megatron Bridge on the node.

What to do

Upgrade Megatron Bridge to 0.5.1; 0.0 through 0.5.0 are affected. Bump the package, rebuild training images, restart jobs. No node drain or reboot. Until then, treat checkpoints and conversion inputs from outside your control as untrusted.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-61755 https://github.com/NVIDIA/product-security/tree/main/2026/5868 https://www.cve.org/CVERecord?id=CVE-2026-61755

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.