CVE-2026-65172: High severity Nvidia AIStore vulnerability
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy.
A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require credentials or user interaction?
No. The vulnerability is exploitable by an unauthenticated remote attacker and requires neither privileges nor user interaction.
Which exposed component is relevant for triage?
The affected interface is the ETL management API on an AIStore proxy. An attacker can send crafted GET or POST requests to that proxy.
What can an attacker do after successful exploitation?
An attacker may access ETL information and control existing ETL jobs, including starting or stopping them. This can disclose information and affect the integrity and availability of ETL data-processing pipelines.