Database/AI/ML frameworks & serving
NVIDIA Megatron Bridge: deserialization of untrusted data gives code execution as the training job
Impact
NVIDIA's bulletin describes deserialization of untrusted data in Megatron Bridge, the library used to move models and checkpoints between Hugging Face and Megatron-LM formats during training and fine-tuning. A local, low-privileged actor who can influence what the library deserializes gets code execution with the identity of the training job, which on a GPU node is a container that already holds the GPU devices, the shared model and dataset mounts, and in Kubernetes the pod's service-account token. The bulletin does not say which input is deserialized, so any externally sourced checkpoint, config or artifact handled by Megatron Bridge should be treated as untrusted. This is one of ten separate deserialization issues fixed together in NVIDIA bulletin 5868, all carrying the same score and vector.
Who can reach it
Local and authenticated. CVSS is AV:L/PR:L, so no network path is claimed: the attacker is a user or process that can already run at low privilege on the node, or that can place data a Megatron Bridge job later deserializes. On a shared trainer, another tenant's job or a common artifact store both fit that description.
What to do
Update Megatron Bridge to 0.5.1; NVIDIA bulletin 5868 lists 0.0 through 0.5.0 as affected and names no workaround. The library ships inside training images, so the cost is rebuilding or re-pulling the image and restarting affected training and conversion jobs - no host reboot and no node drain. Jobs already running keep the vulnerable copy until they are restarted.
References
Related entries
- NVIDIA Megatron Bridge: deserialization of untrusted data gives code execution as the training jobCVE-2026-61776 · NVIDIA Megatron Bridge (model/checkpoint deserialization paths)High
- NVIDIA Megatron Bridge: deserialization of untrusted data gives code execution as the training jobCVE-2026-61777 · NVIDIA Megatron Bridge (model/checkpoint deserialization paths)High
- NVIDIA Megatron Bridge: deserialization of untrusted data gives code execution as the training jobCVE-2026-61778 · NVIDIA Megatron Bridge (model/checkpoint deserialization paths)High
- NVIDIA Megatron Bridge: deserialization of untrusted data gives code execution as the training jobCVE-2026-61779 · NVIDIA Megatron Bridge (model/checkpoint deserialization paths)High
- NVIDIA Megatron Bridge: deserialization of untrusted data gives code execution as the training jobCVE-2026-61770 · NVIDIA Megatron Bridge (model/checkpoint deserialization paths)High
- NVIDIA Megatron Bridge: deserialization of untrusted data gives code execution as the training jobCVE-2026-61771 · NVIDIA Megatron Bridge (model/checkpoint deserialization paths)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.