Read the docs
TI-2026-71782 Aliases CVE-2026-65172GHSA-qxjv-8v85-xw7m

Missing authorization in NVIDIA AIStore ETL management API

Priority MEDIUM 43CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

NVIDIA AIStore for Linux and Kubernetes, AIStore framework versions from 0 to 4.9, contains a missing authorization flaw (CWE-862) in its ETL management API. An unauthenticated remote attacker can access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect ETL data-processing pipelines.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00383 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NVIDIAAIStore framework0 to 4.9—No fix listedCNA
  • AIStore framework VendorNVIDIA Affected 0 to 4.9 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for AIStore framework.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-65172
  2. 2026-10-13 Alias added: GHSA-qxjv-8v85-xw7m

References

Other 3

  • TI-2017-10594 Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a… CVSS 3.1CRITICAL 9.8
  • TI-2025-17134 Time-of-check time-of-use race condition in NVIDIA Container Toolkit CVSS 3.1HIGH 8.3
  • TI-2024-00121 Time-of-check time-of-use race condition in NVIDIA Container Toolkit CVSS 3.1CRITICAL 9.0
  • TI-2024-00076 NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set… CVSS 3.1CRITICAL 9.0
  • TI-2018-02664 Observable discrepancy in Intel Multiple CVSS 3.1MEDIUM 5.5
  • TI-2023-23747 PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers… CVSS 3.1MEDIUM 5.3
See all 1247 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences