CVE-2026-24232: NVIDIA Transformers4Rec RCE Vulnerability

CVE-2026-24232 Overview

CVE-2026-24232 is an insecure deserialization vulnerability [CWE-502] in NVIDIA Transformers4Rec, a library for sequential and session-based recommendation models built on Hugging Face Transformers. An attacker with local access can supply crafted serialized data that Transformers4Rec deserializes without proper validation. Successful exploitation may lead to code execution, data tampering, and information disclosure within the process context of the recommender workload. The vulnerability requires local access and no privileges or user interaction, but its scope changes affected components beyond the vulnerable library itself.

Critical Impact
Improper deserialization of untrusted data in NVIDIA Transformers4Rec can enable local attackers to trigger code execution, tamper with model artifacts, and disclose sensitive information handled by machine learning pipelines.

Affected Products

NVIDIA Transformers4Rec (recommender systems library)
Machine learning pipelines that load serialized Transformers4Rec model or configuration artifacts
Downstream applications embedding Transformers4Rec deserialization routines

Discovery Timeline

2026-07-21 - CVE-2026-24232 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-24232

Vulnerability Analysis

The flaw is an insecure deserialization issue classified under [CWE-502]. Transformers4Rec deserializes data from sources that an attacker can influence, without sufficient integrity or type checks. Python-based ML libraries commonly rely on serialization formats such as pickle, which execute embedded object constructors during load. When such formats are used to hydrate models, configurations, or state, a crafted payload can execute arbitrary Python during the deserialization call.

The CVSS vector indicates a local attack path with a scope change, meaning the exploited component can affect resources outside its own security scope. Impact is limited to availability in the base scoring, but the underlying weakness class also permits code execution, data tampering, and information disclosure as described in the vendor advisory.

Root Cause

Transformers4Rec loads serialized objects from files or streams whose contents are not authenticated. Deserialization routines instantiate classes and invoke methods encoded in the payload before any application-level validation runs. Any process able to place a malicious artifact where the library will read it inherits the ability to execute code within the Python interpreter.

Attack Vector

An attacker with local access to a system running Transformers4Rec plants a malicious serialized artifact — for example a poisoned model checkpoint, tokenizer state, or cached configuration — in a directory the library reads. When a data scientist or automated pipeline loads that artifact, deserialization triggers the attacker-controlled code path. Shared workstations, multi-tenant training hosts, and CI/CD runners that fetch community models are the highest-risk environments.

// No verified public exploit code is available for CVE-2026-24232.
// Refer to the NVIDIA product security advisory for technical details.

Detection Methods for CVE-2026-24232

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running Transformers4Rec workloads, such as shells, curl, or wget.
Model or checkpoint files with recent modification timestamps in shared artifact directories that do not match training job schedules.
Outbound network connections from ML training or inference hosts to unrecognized destinations shortly after model load operations.

Detection Strategies

Monitor pickle.load, torch.load, and joblib.load invocations in Transformers4Rec code paths and alert on loads from user-writable or world-writable locations.
Correlate model artifact reads with subsequent process creation and network activity to identify deserialization-triggered execution.
Track file integrity on model registries and checkpoint directories to detect unauthorized substitution of serialized artifacts.

Monitoring Recommendations

Enable process-level telemetry on ML training and inference hosts with attention to Python subprocess trees.
Log all filesystem writes to model and cache directories used by Transformers4Rec pipelines.
Ingest ML pipeline audit logs into a central data lake for behavioral analysis and retroactive hunting.

How to Mitigate CVE-2026-24232

Immediate Actions Required

Inventory hosts and pipelines that import Transformers4Rec and identify all sources of serialized model artifacts.
Restrict write access to model, tokenizer, and cache directories to authorized service accounts only.
Load Transformers4Rec models exclusively from trusted, signed sources and reject artifacts of unknown provenance.

Patch Information

Refer to the NVIDIA Product Security Advisory for the fixed version of Transformers4Rec and vendor guidance. Additional details are available in the NVD CVE Details and the CVE.org Record for CVE-2026-24232.

Workarounds

Run Transformers4Rec workloads inside isolated containers or sandboxes with least-privilege service accounts and no unnecessary outbound network access.
Verify checksums or cryptographic signatures on all serialized artifacts before loading them into Transformers4Rec.
Prefer safer serialization formats such as safetensors for model weights where the library supports them.

bash

# Restrict permissions on model artifact directories to prevent tampering
chown -R mlservice:mlservice /opt/models/transformers4rec
chmod -R 750 /opt/models/transformers4rec
find /opt/models/transformers4rec -type f -exec sha256sum {} \; > /var/lib/model-integrity/baseline.sha256