NVIDIA Megatron Bridge: deserialization of untrusted data leads to code execution on the training node

CVE-2026-61761AI/ML frameworks & servingcurated

Impact

Megatron Bridge deserializes untrusted data, so anything that can hand the library a crafted artifact - a checkpoint, a converted model, a config read off shared storage - gets code execution with the privileges of the process that loaded it. On a GPU fleet that is arbitrary code inside a container already holding GPUs, with the job's dataset mounts, cluster credentials and writable shared filesystem in reach. Where model conversion runs as a shared service or as a pipeline stage that consumes artifacts produced by another team, this crosses a tenant boundary rather than staying inside one job. NVIDIA scores it 7.8 with local access and low privileges required; the advisory does not name which input path is affected.

Who can reach it

Local. An authenticated user who can run jobs on the fleet, or who can place a model artifact where a Megatron Bridge job will load it. No remote network path is described in the advisory.

What to do

Update Megatron Bridge to 0.5.1 or later from the NVIDIA/Megatron-Bridge GitHub repo; NVIDIA bulletin 5868 lists versions 0.0 through 0.5.0 as affected. Operationally this is a rebuild of the training/conversion container image with the pinned version and a restart of the jobs and any long-lived conversion service using it - no node drain, reboot or firmware work. Until the image is rebuilt, restrict the library to checkpoints and configs from sources you control.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-61761 https://github.com/NVIDIA/product-security/tree/main/2026/5868 https://www.cve.org/CVERecord?id=CVE-2026-61761

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.