CVE-2026-65172
Received Received - Intake

Missing Authorization in NVIDIA AIStore for Linux and Kubernetes

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: NVIDIA Corporation

Description
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-65172
EUVD
EUVD-2026-98560

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
NVIDIA AIStore framework 0 to 4.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NVIDIA AIStore for Linux and Kubernetes has a missing authorization vulnerability in the ETL management API. An unauthenticated remote attacker can access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. This may lead to information disclosure and unauthorized start or stop operations affecting ETL data-processing pipelines.

Detection Guidance

Check network traffic for unauthorized GET or POST requests to AIStore proxy endpoints. Inspect logs for unusual ETL job control actions. Use tools like curl to test proxy endpoints for missing authorization. Example: curl -v http://<aistore-proxy-ip>:<port>/etl/ to verify access without authentication.

Impact Analysis

This vulnerability may allow attackers to access sensitive ETL data, disrupt data processing pipelines, or modify existing ETL jobs without authentication. This could lead to data breaches, service disruptions, or unauthorized changes to critical data processing workflows.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's confidentiality rules. Organizations using AIStore may face compliance violations, legal penalties, and reputational damage due to potential data breaches or unauthorized data processing.

Mitigation Strategies

Restrict access to AIStore proxy endpoints via firewall rules. Update AIStore to the latest patched version. Enable authentication for all ETL management API endpoints. Monitor for unauthorized access attempts and disable unused ETL jobs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65172. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart