Login Request a demo
High severity · published Oct 13, 2026
CVE-2026-65172
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL…
8.6
CVSS
0.4%
EPSS
No
On KEV
Description
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
AIStore framework · NVIDIA
0 to 4.9 · source: vendor
Affected product
AF
AIStore framework
NVIDIA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-65172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-65172
nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-65172
www.cve.org
https://www.cve.org/CVERecord?id=CVE-2026-65172
github.com
https://github.com/NVIDIA/product-security/tree/main/2026/5889
More from AIStore framework
10.0
CVE-2026-65162
NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and…
9.8
CVE-2026-24270
NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication
9.1
CVE-2026-65173
NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted…
8.6
CVE-2026-65101
NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key…
8.6
CVE-2026-65170
NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a…