Mindgard discovered a vulnerability in NVIDIA TensorRT-LLM (v1.3.0rc5), a distributed large language model inference framework for GPU-accelerated serving. The issue affects TensorRT-LLM’s disaggregated serving architecture and manifests in how serialized communication state is transferred between inference components.
TensorRT-LLM accepts a client-supplied encoded_opaque_state field through the /v1/completions API and deserializes it into a backend DataTransceiverState structure without validating authenticity or integrity. That structure contains transport metadata used for UCX and NIXL RDM backend communication.
Exploitation is straightforward. An unauthenticated attacker can submit a crafted payload that influences outbound backend connection behavior.
Mindgard confirmed the issue through live endpoint testing and static analysis. A crafted payload containing attacker-controlled IP and port information successfully passed schema validation and was processed as a trusted backend communication state.
The issue highlights a broader pattern in distributed AI systems where serialized orchestration metadata increasingly functions as trusted execution infrastructure rather than passive state data.
TensorRT-LLM is NVIDIA’s large language model inference framework for high-performance and distributed AI serving workloads. It is used for GPU-accelerated inference, distributed token generation, KV cache management, and disaggregated serving architectures that separate context ingestion from generation execution.
The framework supports communication backends including UCX and NIXL to coordinate data transfer and inference state across GPUs and distributed serving components. In disaggregated deployments, serialized execution metadata is exchanged between services to coordinate inference operations and transport connectivity.
The vulnerable behavior exists within TensorRT-LLM’s disaggregated serving workflow. In normal operation, the context server produces an opaque_state blob containing serialized execution and transport metadata associated with inference coordination. That serialized state is returned through the HTTP API as encoded_opaque_state, forwarded between orchestration components, and later consumed by the generation server during token generation workflows.
Under expected operation, this mechanism allows distributed inference components to coordinate shared execution state across separate serving stages.
The issue arises because the same encoded_opaque_state data is accepted directly from external HTTP clients through the /v1/completions endpoint. The DisaggregatedParams Pydantic model permits arbitrary client-supplied opaque state values without middleware filtering, origin validation, or integrity enforcement.
The execution path begins when an attacker submits a crafted request containing malicious disaggregated_params.encoded_opaque_state data. The payload is base64-decoded through the following logic:
# serve/openai_protocol.py:1083-1086
def decode_opaque_state(encoded_opaque_state: Optional[str]) -> Optional[bytes]:
if encoded_opaque_state is None:
return None
return base64.b64decode(encoded_opaque_state) # ← no validation
The resulting binary blob is then forwarded into backend deserialization logic through deserializeDataTransceiverState() within the TensorRT-LLM executor layer. The deserialization path reconstructs a DataTransceiverState object containing a CommState variant representing backend communication endpoints.
// cpp/tensorrt_llm/executor/serialization.cpp:677-691
DataTransceiverState deserializeDataTransceiverState(std::istream& is) {
// Deserializes CommState with network endpoints zero integrity check
auto commState = deserializeCommState(is);
// ...
}
Critically, the deserialization process performs no integrity verification, authenticity validation, or trust enforcement before reconstructing communication state from attacker-controlled bytes.
The reconstructed CommState can contain either:
SocketState endpoint definitions containing IP and port informationAgentState transport metadata associated with RDMA-capable communicationThe generation server later invokes backend connection management logic using the reconstructed communication state. This causes TensorRT-LLM infrastructure components to establish outbound connections using attacker-defined transport endpoints.
Mindgard reproduced this behavior against a live trtllm-serve instance of NVIDIA Triton TRT-LLM in a docker container (nvcr.io/nvidia/tritonserver:26.01-trtllm-python-py3) with:
TinyLlama/TinyLlama-1.1B-Chat-v1.0 via trtllm-serve on port 8000. The process was as follows:
trtllm-serve instance is started with TinyLlama-1.1B model on the RTX 5090 GPU.encoded_opaque_state is constructed containing a CommState with an attacker-controlled endpoint address, matching the C++ DataTransceiverState binary serialization format./v1/completions endpoint as a generation_only request with disaggregated_params.encoded_opaque_state._enqueue_request in base_worker.py:362, it failed only at the kv_cache_transceiver assertion (not configured for disaggregated mode), not at any opaque_state validation, since there is none.
The important detail in all of this is that the vulnerable behavior is not limited to malformed deserialization or memory corruption. The system is functioning according to intended design assumptions. The failure occurs because externally supplied serialized transport metadata is treated as a trusted backend coordination state.
That distinction matters because the deserialized structure does not merely carry passive data. It directly influences network behavior, backend transport establishment, and GPU communication pathways.
As a result, the issue enables several downstream impacts.
The broader implication is that serialized orchestration metadata in AI serving systems increasingly acts as executable infrastructure state rather than passive coordination data. Once these objects influence transport negotiation, endpoint selection, or memory exchange behavior, they require the same trust enforcement typically applied to authenticated control-plane traffic.
This vulnerability reflects a broader shift across AI infrastructure systems where orchestration metadata and transport coordination increasingly function as execution layers.
Traditional distributed systems typically separate external requests from internal transport coordination using authenticated control planes and strict trust boundaries. AI inference platforms increasingly blur those boundaries because runtime metadata moves dynamically between schedulers, accelerators, KV cache systems, and transport backends.
That creates a new class of risk where serialized state objects become operational authority tokens.
In this case, externally influenced coordination metadata ultimately affected backend network behavior and distributed GPU communication. Once AI systems accept serialized runtime artifacts without cryptographic verification or trust validation, attackers can begin influencing infrastructure-level execution flow rather than only application-layer behavior.
The issue also expands the impact profile of SSRF in AI environments. Instead of targeting only internal HTTP services, SSRF primitives in distributed inference systems may interact directly with GPU communication layers, RDMA infrastructure, and transport fabrics adjacent to model memory and execution systems.
As AI inference architectures become more distributed, serialized runtime coordination objects must be treated as security-sensitive execution artifacts rather than passive metadata.
Mindgard reported the vulnerability to NVIDIA on February 24, 2026, through coordinated disclosure. NVIDIA subsequently assigned CVE-2026-24269 to the issue, with the CVE record officially published on October 27, 2026, and most recently updated on November 4, 2026. NVIDIA also documented the vulnerability in its official product security repository, providing a vendor-maintained reference for the disclosure.
The CVE assignment formally documents the vulnerability in NVIDIA TensorRT-LLM, although the available disclosure information does not establish whether a remediation has been released.
Mindgard's original disclosure recommended introducing cryptographic integrity verification for opaque_state handling, using a cluster-shared signing mechanism such as HMAC validation. This approach would help ensure that generation servers only deserialize transport state produced by trusted infrastructure components, preventing externally supplied metadata from influencing backend communication and inference execution.
AI inference infrastructure is rapidly evolving from a monolithic model serving into highly distributed execution architectures. That shift fundamentally changes where trust boundaries exist.
Distributed inference introduces hidden control planes: Modern inference systems exchange runtime metadata continuously across schedulers, executors, cache layers, transport backends, and accelerator coordination services. These coordination pathways increasingly function as infrastructure control channels.
Serialized state is becoming operational authority: Objects originally designed as transport containers or execution metadata now influence connection establishment, memory access behavior, workload routing, and orchestration decisions.
AI infrastructure increasingly overlaps with high-performance computing infrastructure: GPU communication layers, RDMA transports, and disaggregated memory coordination expose attack surfaces historically associated with clustered compute systems rather than conventional web applications.
Inference-layer compromise can affect model integrity itself: Manipulation of KV cache state or distributed inference coordination may alter downstream model behavior without modifying the model weights directly.
Traditional application security assumptions no longer fully apply: Security controls focused exclusively on HTTP request handling or API validation may miss execution pathways occurring within inference orchestration and backend transport coordination layers.
For organizations deploying distributed AI serving infrastructure, these issues introduce operational risks extending beyond application compromise. Inference environments increasingly sit adjacent to sensitive datasets, proprietary models, GPU clusters, and production AI pipelines. Once trust boundaries collapse between external requests and internal coordination systems, attackers may gain influence over the infrastructure responsible for model execution itself.
This issue highlights an increasingly important reality in AI infrastructure security: execution no longer begins only where code runs.
In distributed AI systems, serialized coordination artifacts, transport metadata, orchestration state, and runtime execution descriptors increasingly determine how infrastructure behaves. These objects influence network connectivity, memory exchange, inference routing, and accelerator coordination even when they are not traditionally classified as executable content.
The TensorRT-LLM issue demonstrates how quickly trust assumptions can collapse when externally supplied coordination state is allowed to cross directly into backend execution pathways. An HTTP request becomes serialized transport metadata. Serialized transport metadata becomes backend connection state. Backend connection state influences distributed GPU infrastructure behavior.
That transition from request data into infrastructure authority is becoming a recurring pattern across AI-native systems.
Mindgard is publishing this disclosure to document the issue, clarify the underlying execution flow, and highlight the broader security implications emerging across distributed AI infrastructure ecosystems.
Mindgard secures AI models, agents, and applications against exploitable threats. Spun out of more than a decade of pioneering AI security research at Lancaster University, Mindgard combines offensive security expertise, AI red teaming, attacker intelligence, and automated protection to help organizations discover, assess, and mitigate risk across AI models, agents, and applications.
