NVIDIA bug bounty programs
nvidia.com Updated
NVIDIA runs three public programs: an Intigriti bug bounty paying up to $15,000, a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $15,000
- Intigriti
- Programs
- 3
- 2 pay cash
- Targets in scope
- 26
- 3 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
NVIDIA Public Bug Bounty
Intigriti · Pays the most of the 3 programs: up to $15,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
NVIDIA Public Bug Bounty
Intigriti · Bug bounty |
$15k (highest) | $4,000 (highest) | $2,000 (highest) | $300 (highest) | $15,000 | Full | – | – | Open |
|
Triton Inference Server
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | – | Open |
|
NVIDIA Product Security
Self-hosted · Disclosure only |
– | – | – | – | No cash | – | – | – | Open |
-
- Critical
- $15k (highest)
- High
- $4,000 (highest)
- Medium
- $2,000 (highest)
- Low
- $300 (highest)
- Safe harbor
- Full
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
26 targets across all 3 programs, each listed once with the programs that cover it. 6 excluded.
-
Ensembles and business logic scripting, which chain models and pass tensors between them
Products and areas
Covered by Sorona
-
Every backend the server ships: TensorRT, ONNX Runtime, PyTorch, TensorFlow, OpenVINO, Python, DALI, FIL and the vLLM backend
Products and areas
Covered by Sorona
-
Model configuration parsing, covering config.pbtxt, the auto-complete path and the model warmup configuration
Products and areas
Covered by Sorona
-
NVIDIA accepts reports through PSIRT and through its Intigriti vulnerability disclosure programme, whose scope is all NVIDIA assets and which states it operates without bounties. Nothing narrower than the Triton server is carved out
Products and areas
Covered by Sorona
-
Request and tensor parsing in full, including the binary tensor extension, the raw content payloads and the shape and datatype validation in front of them
Products and areas
Covered by Sorona
-
The client libraries and the Performance Analyzer and Model Analyzer tools the project ships
Products and areas
Covered by Sorona
-
The HTTP and REST endpoints, the gRPC service and the KServe v2 inference protocol implementation on both
Products and areas
Covered by Sorona
-
The metrics, health, statistics and tracing endpoints and what each exposes about loaded models
Products and areas
Covered by Sorona
-
The model repository, repository polling, and the model control API that loads and unloads models at runtime
Products and areas
Covered by Sorona
-
The Python backend specifically, its stub process model and the boundary between model-supplied code and the server process
Products and areas
Covered by Sorona
-
The repository agent API and the cloud storage fetchers for S3, GCS and Azure, including checksum verification
Products and areas
Covered by Sorona
-
The sequence batcher, the dynamic batcher and any state carried across requests on behalf of a client
Products and areas
Covered by Sorona
-
The shared memory and CUDA shared memory input paths, where a client names a region the server maps and reads
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
A server deliberately exposed to an untrusted network with the model control API open
Sorona
-
CUDA, the GPU driver and the device firmware, all of which have their own NVIDIA advisory stream
Sorona
-
Model output content, hallucination and prompt-level behaviour, none of which are software defects in the server
Sorona
-
NVIDIA's own cloud services and NGC infrastructure
Sorona
-
PyTorch, TensorFlow, ONNX Runtime and other frameworks as upstream projects, unless Triton's backend integration is what makes the defect reachable
Sorona
-
The models and weights themselves, whose provenance is the operator's choice
Sorona
Recent changes
Reward and scope changes across every NVIDIA program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in NVIDIA products, from the NVD.
-
CVE-2026-65179 High
NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.
-
CVE-2026-65178 High
NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.
-
CVE-2026-65179 High
NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.
-
CVE-2026-65178 High
NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.
-
CVE-2026-65127 Medium
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information due to uncleared debug information. A successful exploit of this vulnerability might lead to information disclosure.
-
CVE-2026-65128 High
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
-
CVE-2026-65129 Medium
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
-
CVE-2026-65125 Medium
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service.
About this page
This page gathers every public program listed under nvidia.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.