CVE-2026-113743 in tt-metal
Summary
by MITRE • 10/22/2026
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
A critical security vulnerability has been identified within Tenstorrent's tt-metal framework, specifically affecting versions up through 0.80.0. The flaw resides in the load_hf_state_dict_filtered function located in the models/tt_transformers/tt/load_checkpoints.py file. This component is responsible for loading model state dictionaries from Hugging Face formats into the Tenstorrent architecture, a process that involves parsing and validating file paths to locate checkpoint weights. The vulnerability stems from an improper restriction of path traversal attacks, allowing an attacker to manipulate the weight_map argument to access files outside the intended directory structure. This type of flaw is classically categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which highlights the failure to properly sanitize or validate user-supplied input that determines file system paths.
The technical nature of this vulnerability allows for remote exploitation, meaning an attacker does not need local access to the machine running the tt-metal framework to initiate an attack. By crafting a malicious weight_map payload containing directory traversal sequences such as dot-dot-slash characters, an adversary can trick the application into reading arbitrary files from the underlying operating system. This capability significantly expands the potential impact beyond simple data corruption or denial of service. Instead, it enables unauthorized access to sensitive configuration files, private keys, credentials stored on disk, or other critical system resources that reside outside the designated model directory. The existence of a public exploit further lowers the barrier for entry, enabling less sophisticated attackers to leverage this weakness against vulnerable deployments.
From an operational perspective, the impact of this vulnerability is severe due to its remote nature and the high privileges typically held by machine learning workloads. If successfully exploited, an attacker could achieve arbitrary file read access on the host system. This can lead to a cascade of subsequent attacks, including credential theft, lateral movement within a network, or complete compromise of the infrastructure hosting the AI models. The vulnerability aligns with ATT&CK technique T1083: File and Directory Discovery, as it facilitates the enumeration and retrieval of files from the target system without detection by standard application-level controls that do not inspect file path semantics deeply enough to catch traversal attempts.
To mitigate this risk, immediate action is required for all systems running Tenstorrent tt-metal versions prior to 0.81.0-dev20261016. The recommended remediation strategy is to upgrade the affected component to version 0.81.0-dev20261016 or later, where this path traversal issue has been addressed in patch commit 4851ccf347f6903c3d819eed60705600386e52c3. Until the upgrade is performed, organizations should implement strict input validation on any external inputs that influence file path resolution within the load_hf_state_dict_filtered function if possible through wrapper scripts or middleware. Additionally, deploying runtime application self-protection tools or host-based intrusion detection systems can help monitor for anomalous file access patterns indicative of directory traversal attempts. Regular security audits and adherence to secure coding practices regarding filesystem interactions are essential to prevent similar vulnerabilities in future development cycles.