CVE-2026-113743
Last modified
CVE-2026-113743 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py.
Description
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Tenstorrent | tt-metal | 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11; 0.12; 0.13; 0.14; 0.15; 0.16; 0.17; 0.18; 0.19; 0.20; 0.21; 0.22; 0.23; 0.24; 0.25; 0.26; 0.27; 0.28; 0.29; 0.30; 0.31; 0.32; 0.33; 0.34; 0.35; 0.36; 0.37; 0.38; 0.39; 0.40; 0.41; 0.42; 0.43; 0.44; 0.45; 0.46; 0.47; 0.48; 0.49; 0.50; 0.51; 0.52; 0.53; 0.54; 0.55; 0.56; 0.57; 0.58; 0.59; 0.60; 0.61; 0.62; 0.63; 0.64; 0.65; 0.66; 0.67; 0.68; 0.69; 0.70; 0.71; 0.72; 0.73; 0.74; 0.75; 0.76; 0.77; 0.78; 0.79; 0.80.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-113743?
How severe is CVE-2026-113743?
How do I fix CVE-2026-113743?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-113736A vulnerability has been found in D-Link DHP-W610AV 1.02EUb0…9.8
- CVE-2026-113737A flaw has been found in R6410418 Jackrong-llm-finetuning-gu…5.5
- CVE-2026-113738A vulnerability has been found in R6410418 Jackrong-llm-fine…6.3
- CVE-2026-11374In ManageEngine ADSelfService Plus, RecoveryManager Plus, M3…9
- CVE-2026-113740A flaw has been found in itsourcecode Online Cake Ordering S…6.3
- CVE-2026-113741A vulnerability has been found in itsourcecode Online Cake O…4.3
- CVE-2026-113744A security vulnerability has been detected in Tenda AC19 16.…10
- CVE-2026-11375IBM MQ could allow an authenticated attacker to cause a deni…8.8
- CVE-2026-113776virtualenv is a tool for creating isolated virtual python en…7.8
- CVE-2026-113779The pfSense REST API package is an unofficial, open-source R…8.8
- CVE-2026-11378IBM MQ could allow an authenticated attacker to cause a deni…8.8
- CVE-2026-113786pypdf is a free and open-source pure-python PDF library. Pri…2.3
Are you affected by CVE-2026-113743?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST