CVE-2026-65172CWE-862broken-access-control

CVE-2026-65172

High · published October 13, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
31.1
In the wild
Unconfirmed
What it is

NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy.

A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00383 · 31.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-13T17:17Z
References (3)
https://github.com/NVIDIA/product-security/tree/main/2026/5889 · [email protected]https://nvd.nist.gov/vuln/detail/CVE-2026-65172 · [email protected]https://www.cve.org/CVERecord?id=CVE-2026-65172 · [email protected]
EPSS history
Timeline
  • 15 OCT 03:33Z
    EPSS moved — → 0%
    epss
  • 13 OCT 13:00Z
    NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may…
    cvelistv5
  • 13 OCT 13:00Z
    NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may…
    cvelistv5