CVE-2026-61753: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in NVIDIA Megatron Bridge

NVIDIA Megatron Bridge contains a path traversal vulnerability (CWE-22) that enables an attacker with local access and low privileges to trigger deserialization of untrusted data. This flaw can result in high-impact consequences including arbitrary code execution, unauthorized modification of data, and leakage of sensitive information. The CVSS 3.1 base score is 7.8, reflecting high confidentiality, integrity, and availability impacts. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation can lead to full compromise of the affected system through code execution, unauthorized data modification, and information disclosure. The vulnerability requires local access with low privileges and does not require user interaction. The impact is rated high due to the potential severity of these outcomes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to the affected software and monitor for suspicious activity related to deserialization processes.