High severity · published Oct 27, 2026
CVE-2026-24269
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery
New
7.1
CVSS
–
EPSS
No
On KEV
Description
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
TensorRT-LLM · NVIDIA
1.3.0rc24 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24269
github.com
https://github.com/NVIDIA/product-security/tree/main/2026/5883
nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-24269
www.cve.org
https://www.cve.org/CVERecord?id=CVE-2026-24269
More from TensorRT-LLM
9.8
CVE-2026-24163
NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization
9.8
CVE-2026-24142
NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle
9.8
CVE-2025-33255
NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization
8.4
CVE-2026-65119
NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted…
8.4
CVE-2026-24233
NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause…