CVE-2026-24218
NVIDIA DGX OS SSH Host Key Cloning Vulnerability
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: NVIDIA Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nvidia | dgx_os | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-321 | The product uses a hard-coded, unchangeable cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in NVIDIA DGX OS involves the deployment of identical SSH host keys across multiple systems, enabling host impersonation or man-in-the-middle attacks. Such security weaknesses can lead to unauthorized access, data tampering, information disclosure, and privilege escalation.
These impacts could potentially affect compliance with common standards and regulations like GDPR and HIPAA, which require the protection of sensitive data and secure system access controls. Specifically, the risk of information disclosure and unauthorized access may violate requirements for data confidentiality and integrity under these regulations.
However, the provided context and resources do not explicitly discuss or confirm the direct effects of this vulnerability on compliance with GDPR, HIPAA, or other standards.
Can you explain this vulnerability to me?
This vulnerability exists in NVIDIA DGX OS's factory provisioning process, where cloning a base image causes identical SSH host keys to be deployed across multiple systems.
Because these cryptographic identifiers are shared among all similarly provisioned systems, it enables attackers to impersonate hosts or perform man-in-the-middle attacks.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to several serious impacts including code execution, data tampering, escalation of privileges, information disclosure, and denial of service.