CVE-2026-24234: NVIDIA TensorRT-LLM SSRF Vulnerability

CVE-2026-24234 Overview

CVE-2026-24234 is a server-side request forgery (SSRF) vulnerability in NVIDIA TensorRT-LLM for Linux. The flaw resides in the multimodal media fetching functions, which retrieve external resources such as images or audio for large language model (LLM) inference. A network-accessible attacker can coerce the TensorRT-LLM process into issuing arbitrary outbound requests. Successful exploitation may result in denial of service and information disclosure, including access to internal metadata endpoints or restricted network services.

The vulnerability is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
An attacker submitting crafted media URLs to a TensorRT-LLM inference endpoint can pivot the server into internal networks, exfiltrate metadata, or exhaust resources through forced outbound requests.

Affected Products

NVIDIA TensorRT-LLM for Linux
Deployments exposing multimodal (image, video, audio) inference endpoints
Container and cloud workloads running vulnerable TensorRT-LLM builds

Discovery Timeline

2026-07-14 - CVE-2026-24234 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-24234

Vulnerability Analysis

TensorRT-LLM supports multimodal inference workloads that accept references to remote media assets. The framework fetches these assets over the network before passing them to the model pipeline. When the fetching logic accepts attacker-controlled URLs without adequate validation of scheme, host, or destination address, the server can be induced to request arbitrary internal or external endpoints on behalf of the attacker.

This SSRF pattern is particularly consequential in AI inference stacks because they frequently run inside cloud instances with access to cloud metadata services, internal APIs, and privileged model registries. An attacker exploiting the flaw can enumerate internal network topology, retrieve instance credentials from metadata endpoints, or trigger repeated large downloads to exhaust bandwidth and memory.

The issue may also produce denial of service when the fetcher is directed at slow-responding hosts or excessively large payloads. Because the attack surface is exposed by any application that forwards user-supplied media references to TensorRT-LLM, the effective reach extends beyond direct users of the library.

Root Cause

The root cause is insufficient validation of URLs supplied to the multimodal media fetching functions. Requests are dispatched without enforcing allowlists on target hosts, blocking private IP ranges, or restricting URL schemes to safe protocols.

Attack Vector

Exploitation requires the attacker to reach an application or service that passes media references into TensorRT-LLM. The attacker supplies a URL pointing to an internal address such as a cloud metadata service, an internal admin interface, or a resource designed to trigger a denial of service. The vulnerable process performs the outbound request and, depending on error handling, may return response content or timing signals to the attacker.

No verified public proof-of-concept exploit is available. See the NVD advisory for authoritative technical details.

Detection Methods for CVE-2026-24234

Indicators of Compromise

Outbound HTTP requests from TensorRT-LLM processes to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Connections from inference hosts to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that were not part of normal model traffic.
Repeated fetch attempts against non-standard ports or unusual URL schemes (file://, gopher://, ftp://) in application logs.

Detection Strategies

Instrument the multimodal ingestion path to log every fetched URL along with the requesting user or session identifier.
Correlate inference request payloads with egress network flows to identify user-supplied URLs that resolve to internal ranges.
Alert on anomalous spikes in outbound bandwidth or request rates originating from TensorRT-LLM workers.

Monitoring Recommendations

Enable egress firewall logging on inference hosts and forward events to a centralized analytics platform for baseline analysis.
Monitor cloud audit logs for unexpected calls to instance metadata endpoints from AI workload subnets.
Track process-level network telemetry to associate outbound sockets with the TensorRT-LLM runtime.

How to Mitigate CVE-2026-24234

Immediate Actions Required

Restrict egress network access from TensorRT-LLM hosts to only the endpoints required for model operation.
Block access to cloud instance metadata services from inference containers, or require IMDSv2-style session tokens on AWS.
Validate and sanitize any user-supplied URLs before forwarding them to TensorRT-LLM multimodal endpoints.

Patch Information

Apply the fixed version of NVIDIA TensorRT-LLM once published by NVIDIA. Consult the NVIDIA security bulletins and the NVD entry for CVE-2026-24234 for the most current patched release information.

Workarounds

Enforce a URL allowlist at the application layer, permitting only trusted media storage domains.
Reject URLs that resolve to private, loopback, link-local, or reserved IP ranges before invoking the fetch functions.
Run TensorRT-LLM inside a network namespace or sidecar proxy that proxies and filters all outbound requests.

bash

# Example egress restriction using iptables to block metadata service access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP