NVIDIA Megatron Bridge: deserialization of untrusted data allows code execution in the training job

CVE-2026-61756AI/ML frameworks & servingcurated

Impact

Megatron Bridge deserializes untrusted data, which can lead to code execution, data tampering, and information disclosure. The attacker ends up running as the training job on a GPU node - with its devices, its dataset and checkpoint mounts, and its injected secrets. On a multi-team fleet the meaningful path is artifact supply rather than network reach: a checkpoint or conversion input from another team or a public hub executes in the job that loads it. One of eight deserialization CVEs in NVIDIA bulletin 5868, all sharing the same description.

Who can reach it

Local, low privileges required, no user interaction - an attacker able to supply a serialized artifact that a Megatron Bridge process loads on the node.

What to do

Upgrade Megatron Bridge to 0.5.1; versions 0.0 through 0.5.0 are affected. Rebuild training images with the fixed package and restart jobs to pick it up. No node drain, reboot, or firmware work.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-61756 https://github.com/NVIDIA/product-security/tree/main/2026/5868 https://www.cve.org/CVERecord?id=CVE-2026-61756

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.