CVE-2026-24229: NVIDIA TensorRT-LLM Information Disclosure

CVE-2026-24229 Overview

CVE-2026-24229 is a missing authentication vulnerability [CWE-306] in NVIDIA TensorRT-LLM for Linux. The flaw resides in the disaggregated orchestrator component, which exposes a FastAPI server without proper access controls. An attacker with local access can send unauthenticated requests to read, write, or delete internal cluster state managed by the orchestrator. Successful exploitation leads to information disclosure, data tampering, and denial of service across the inference cluster. The vulnerability affects Linux deployments that run TensorRT-LLM with the disaggregated serving architecture used for large language model inference workloads.

Critical Impact
An unauthenticated local attacker can manipulate internal cluster state of NVIDIA TensorRT-LLM disaggregated orchestrators, resulting in information disclosure, tampering of inference state, and denial of service.

Affected Products

NVIDIA TensorRT-LLM for Linux
Disaggregated orchestrator component
FastAPI server exposed by the orchestrator

Discovery Timeline

2026-07-14 - CVE-2026-24229 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-24229

Vulnerability Analysis

NVIDIA TensorRT-LLM supports a disaggregated serving mode that separates the prefill and decode phases of large language model inference across worker nodes. An orchestrator component coordinates these workers and exposes a FastAPI-based HTTP interface for cluster management operations. The interface is used to register workers, query state, and dispatch inference tasks.

The orchestrator does not enforce authentication on its FastAPI endpoints. Any process able to reach the server on the local host can issue arbitrary read, write, and delete operations against the internal cluster state store. This includes worker registration data, routing tables, and inference metadata used to service in-flight requests.

The vulnerability is categorized as Missing Authentication for Critical Function [CWE-306]. Because the FastAPI server acts as the control plane for the inference cluster, unauthorized state modification directly translates into tampering with production model serving.

Root Cause

The root cause is the absence of an authentication layer on the FastAPI server that fronts the disaggregated orchestrator. The service was designed to run in a trusted execution environment, but no session tokens, mutual TLS, or API keys are required to invoke sensitive endpoints. All callers are treated as authorized.

Attack Vector

Exploitation requires local access to the host or namespace where the orchestrator listens. An attacker such as a low-privileged local user, a co-tenant container, or a compromised sidecar sends crafted HTTP requests to the FastAPI endpoints. The requests can enumerate cluster state (information disclosure), overwrite routing or worker configuration (tampering), or delete state entries required for continued operation (denial of service). No user interaction is required, and no prior authentication is needed. Refer to the NVD CVE-2026-24229 Details for the authoritative vector description.

Detection Methods for CVE-2026-24229

Indicators of Compromise

Unexpected HTTP requests to the TensorRT-LLM disaggregated orchestrator FastAPI port from local processes not associated with the inference workflow.
Unauthorized modifications to worker registration, routing tables, or cluster state entries maintained by the orchestrator.
Abrupt worker deregistration events or inference request failures without a corresponding operator action.

Detection Strategies

Monitor local network sockets bound by the orchestrator process and alert on connections originating from unexpected user IDs or containers.
Enable FastAPI access logging and correlate request source, endpoint, and method against an allow-list of legitimate orchestrator clients.
Baseline normal orchestrator API traffic patterns and flag anomalous write or delete operations against cluster state endpoints.

Monitoring Recommendations

Forward orchestrator logs and host process telemetry to a centralized analytics platform for retention and correlation.
Track process-to-port relationships on inference hosts to detect unauthorized clients contacting the orchestrator.
Alert on inference cluster state changes that occur outside of scheduled deployment or scaling windows.

How to Mitigate CVE-2026-24229

Immediate Actions Required

Restrict network access to the disaggregated orchestrator FastAPI port so only trusted orchestrator clients on the local host can connect.
Run TensorRT-LLM inference workloads under dedicated user accounts and isolate them from other tenants using Linux namespaces or containers.
Audit local processes with access to the orchestrator port and remove any that do not require it.

Patch Information

Apply the vendor-supplied update for NVIDIA TensorRT-LLM once available. Consult the NVD CVE-2026-24229 Details and the CVE.org Record for CVE-2026-24229 for the current fixed versions and vendor advisory links.

Workarounds

Bind the FastAPI server to the loopback interface only, preventing exposure to other interfaces or containers on the host.
Place a reverse proxy in front of the orchestrator that enforces authentication, such as mutual TLS or an API key, before requests reach the FastAPI server.
Apply host-based firewall rules to limit which local UIDs or cgroups can establish connections to the orchestrator port.

bash

# Example: restrict access to the orchestrator port using iptables owner match
# Replace <ORCH_PORT> with the FastAPI listening port and <TRUSTED_UID> with the service account UID
iptables -A INPUT -p tcp --dport <ORCH_PORT> -m owner --uid-owner <TRUSTED_UID> -j ACCEPT
iptables -A INPUT -p tcp --dport <ORCH_PORT> -j DROP