Database/AI/ML frameworks & serving
NVIDIA Megatron-LM: hash collisions in the inference cache let one request's data reach another
Impact
The cache Megatron-LM keeps for inference requests can be made to collide, so a crafted request is served content keyed to a different one. NVIDIA scores this with a changed scope and network vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N), meaning the effect crosses the boundary of the component itself - on a shared endpoint that is one tenant's request influencing or partially reading another's. Integrity is the high half: responses can be tampered with, with only partial disclosure. Attack complexity is high, so this is not a casual exploit, but on a multi-tenant inference endpoint it is a cross-tenant issue rather than a local one.
Who can reach it
Network, authenticated low-privileged user, no interaction - any client able to submit inference requests to a Megatron-LM endpoint that caches them.
What to do
Upgrade Megatron-LM to the fixed version in NVIDIA bulletin 2026/5881 and restart the inference service; the same upgrade covers the checkpoint-loading ids in that bulletin. If you cannot patch immediately, disabling or partitioning the inference request cache per tenant removes the shared-state precondition. The NVD record does not name a fixed version.
References
Related entries
- torchvision (GIF decoder): Out-of-bounds heap read in `read_from_tensor` GIF decodeCVE-2026-65918 · torchvision (GIF decoder)High
- MLflow: model version creation reads another user's run artifacts without READ permissionCVE-2026-69148 · MLflow tracking server (CreateModelVersion source run/model validation)High
- MLflow AI Gateway: unvalidated api_base in gateway secrets turns the proxy endpoint into an authenticated SSRFCVE-2026-71211 · MLflow AI Gateway (gateway secret auth_config.api_base, raw_proxy endpoint)High
- Hugging Face tokenizers: crafted tokenizer.json aborts the process while loading a BPE modelCVE-2026-85670 · Hugging Face tokenizers (BpeBuilder::build, BPE merge loading)High
- Jupyter Server: Referer header is logged unscrubbed, leaking auth tokens into server logsCVE-2026-86049 · Jupyter Server (5xx request logging in jupyter_server/log.py)High
- n8n OpenAI Chat Model node: model-search path ignores credential domain limits and leaks the API keyCVE-2026-86082 · n8n OpenAI Chat Model node (LMChatOpenAi loadModels.ts model-search path)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.