CVE-2026-24229 is a high-severity vulnerability in NVIDIA TensorRT-LLM's disaggregated orchestrator component on Linux. The issue arises from missing authentication controls on critical functions exposed via the FastAPI server, enabling an unauthenticated attacker with local access to manipulate internal cluster state. The impact includes potential unauthorized information disclosure, data tampering, and denial of service conditions. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) reflects local attack vector with low complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. No vendor advisory or patch information is currently available.

An attacker with local access to the affected system can exploit the missing authentication to read, modify, or delete internal cluster state data. This can result in unauthorized disclosure of sensitive information, tampering with data integrity, and disruption of service availability. The vulnerability affects confidentiality most severely, with moderate impacts on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to the FastAPI server component and monitor for unauthorized access attempts. Follow NVIDIA's advisories for updates and apply patches promptly once available.