What happened
NVIDIA disclosed (advisory 2026/5883, published 2026-10-27) that TensorRT-LLM's KvCacheAwareRouter tokenizer loading can include functionality from an untrusted control sphere, leading to code execution, information disclosure, data tampering, and denial of service (CVSS 8.4). The same advisory documents two SSRF flaws (CVE-2026-24269, CVE-2026-65120) in the product.
Why it matters
TensorRT-LLM is core production LLM-inference infrastructure. A tokenizer-loading path that accepts untrusted content is a model-loading supply-chain risk: loading a malicious tokenizer gives attacker code execution inside the serving engine, with access to the service account, GPU tensors, and model artifacts.
Attack vector
An attacker who can influence which tokenizer the KvCacheAwareRouter loads (e.g. via a model/tokenizer directory or served artifact) pulls in functionality from an untrusted control sphere, enabling code execution, information disclosure, data tampering, or denial of service in the serving process.
Affected systems
NVIDIA TensorRT-LLM (advisory 2026/5883); related SSRF issues CVE-2026-24269 / CVE-2026-65120 (CVSS 7.1) also disclosed
Mitigation
Apply NVIDIA product-security bulletin 2026/5883; validate and pin tokenizer/model artifacts and restrict which paths the serving engine will load from (treat model directories as trusted, signed inputs).