EUVD-2026-24147
GHSA-h643-x86r-86v6
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints without authorization. A successful exploit of this vulnerability might lead to information disclosure.
AnalysisAI
Authorization bypass in NVIDIA KAI Scheduler allows authenticated network attackers to access protected API endpoints and disclose sensitive information across security boundaries. The vulnerability (CWE-306: Missing Authentication for Critical Function) enables low-privileged authenticated users to read high-value data outside their intended scope (CVSS scope changed to 'C', high confidentiality impact). …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all NVIDIA KAI Scheduler deployments and document current user privilege assignments; notify NVIDIA account team and retrieve advisory 5818 remediation guidance. Within 7 days: Implement network segmentation and API access controls per NVIDIA advisory 5818; apply any available configuration hardening recommendations. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today