CVE-2026-65172

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-13
Weakness: CWE-862

Description

NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.

Affected products

NVIDIA AIStore framework: from 0 through 4.9

References

https://github.com/NVIDIA/product-security/tree/main/2026/5889
https://nvd.nist.gov/vuln/detail/CVE-2026-65172
https://www.cve.org/CVERecord?id=CVE-2026-65172

Get alerted when CVE-2026-65172 or the next vulnerability affects your stack