{"id":"CVE-2026-65119","kind":"vulnerability","aliases":["CVE-2026-65119"],"related":[],"title":"NVIDIA TensorRT-LLM: KvCacheAwareRouter tokenizer loading can run attacker code","description":"NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere. A successful exploit might lead to code execution, information disclosure, data tampering, and denial of service.","summary":"NVIDIA TensorRT-LLM loads a tokenizer in its KvCacheAwareRouter from a source an attacker can influence, pulling in code from an untrusted control sphere. A successful exploit can lead to code execution, information disclosure, data tampering, or denial of service.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-serving","nvidia","python","tensorrt-llm"],"not_affected_if":["router-not-used"],"how_to_check":"- Check the installed TensorRT-LLM version with `pip show tensorrt_llm` and compare it to the fixed version in the NVIDIA advisory.\n- Check whether the KvCacheAwareRouter is enabled in your serving configuration; the sources do not say which settings enable it.","fix":"- Upgrade TensorRT-LLM to the patched release named in the NVIDIA security bulletin (version unknown from the sources).\n- Until patched, restrict which tokenizer paths or model repositories the router can load from; the sources do not give a specific workaround.","status":"open","published_at":"2026-10-27T13:16:59+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","triaged_at":"2026-10-27T13:32:21+00:00","updated_at":"2026-10-27T13:32:21+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-27T13:32:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade TensorRT-LLM to the patched release named in the NVIDIA security bulletin (version unknown from the sources).\n- Until patched, restrict which tokenizer paths or model repositories the router can load from; the sources do not give a specific workaround.","reach":"unknown","title":"NVIDIA TensorRT-LLM: KvCacheAwareRouter tokenizer loading can run attacker code","impact":"high","summary":"NVIDIA TensorRT-LLM loads a tokenizer in its KvCacheAwareRouter from a source an attacker can influence, pulling in code from an untrusted control sphere. A successful exploit can lead to code execution, information disclosure, data tampering, or denial of service.","category":"ai-tooling","nicknames":[],"who_cares":["tensorrt-llm","nvidia","llm-serving","python"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker code runs on the inference server with its privileges.","analyst_note":"Check the NVIDIA security bulletin for the fixed version, the trigger conditions and whether the KvCacheAwareRouter is on by default, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-65119.","how_to_check":"- Check the installed TensorRT-LLM version with `pip show tensorrt_llm` and compare it to the fixed version in the NVIDIA advisory.\n- Check whether the KvCacheAwareRouter is enabled in your serving configuration; the sources do not say which settings enable it.","needs_analyst":true,"not_affected_if":["router-not-used"],"who_is_affected":"Teams running NVIDIA TensorRT-LLM with the KvCacheAwareRouter on any platform, especially where tokenizer or model files come from outside sources. The sources do not say which router configurations are exposed, so teams that do not use the KvCacheAwareRouter can likely skip it, but this is unconfirmed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":3334,"output_tokens":721,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65119':14A,17A 'ai':19B 'ai-tool':18B 'attack':10A,43B,86C 'caus':88C 'code':11A,48B,60B,103C 'contain':77C 'control':52B,95C 'could':87C 'cve':12A,15A 'data':64B,107C 'denial':67B,110C 'disclosur':63B,106C 'execut':61B,104C 'exploit':56B,99C 'function':91C 'inclus':89C 'influenc':45B 'inform':62B,105C 'kvcacheawarerout':5A,38B,81C 'lead':58B,101C 'llm':4A,22B,28B,32B,73C 'llm-serv':21B 'load':7A,33B,83C 'might':100C 'nvidia':1A,24B,29B,70C 'platform':76C 'pull':46B 'python':25B 'run':9A 'serv':23B 'servic':69B,112C 'sourc':41B 'sphere':53B,96C 'success':55B,98C 'tamper':65B,108C 'tensorrt':3A,27B,31B,72C 'tensorrt-llm':2A,26B,30B,71C 'token':6A,35B,82C 'tool':20B 'untrust':51B,94C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Teams running NVIDIA TensorRT-LLM with the KvCacheAwareRouter on any platform, especially where tokenizer or model files come from outside sources. The sources do not say which router configurations are exposed, so teams that do not use the KvCacheAwareRouter can likely skip it, but this is unconfirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T13:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@nvidia.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65119","severity":null,"published_at":"2026-10-27T13:16:59+00:00","modified_at":"2026-10-27T13:16:59+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","fetched_at":"2026-10-27T13:31:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}