EUVD-2026-26077Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain valid Flare SDK credentials
-
DeliveryAuthenticate to SDK interface
-
ExploitCraft request with path traversal payload
-
InstallSubmit to file access endpoint
-
C2SDK processes unsanitized path
-
ExecuteRead unauthorized file
-
ImpactExfiltrate sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires valid authenticated credentials to access the NVIDIA Flare SDK interface or API (PR:L in CVSS vector). The attacker must identify a file parameter or API endpoint that processes file paths without proper validation. No special SDK configuration or non-default setup is explicitly mentioned as required. The vulnerability is accessible remotely over the network (AV:N) without user interaction (UI:N), but only after authentication is established. The vulnerability does NOT require elevated privileges beyond standard user access. |
| Impact | CVSS score of 6.5 (Medium) with network attack vector and low complexity reflects moderate risk. The requirement for authenticated access (PR:L) significantly limits real-world exposure compared to unauthenticated remote vulnerabilities. EPSS data is not available for independent validation of exploitation probability. The confidentiality impact is rated high (C:H), meaning successful exploitation grants access to sensitive data, but integrity and availability are unaffected (I:N/A:N). The confined scope (S:U) indicates the vulnerability does not breach security boundaries of other systems. No KEV listing or POC identified, suggesting this is not currently exploited in the wild at scale. For organizations using Flare in trusted environments with limited user access, risk is lower; for multi-tenant or open-access deployments, risk is higher. The combination of mandatory authentication and information-disclosure-only impact makes this a lower priority than remote unauthenticated code execution vulnerabilities, but still requires remediation in security-sensitive deployments. |
| Exploit ScenarioDerived | An authenticated user with access to a Flare SDK instance crafts a malicious request with path traversal sequences in a file parameter (e.g., '../../../etc/passwd'). The SDK fails to validate or sanitize the input, processes it as-is, and returns the contents of the sensitive file outside the intended directory. The attacker gains access to configuration files, credentials, model data, or other confidential information stored on the server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 28, 2026
NVIDIA Flare SDK is vulnerable to path traversal via improper input validation, allowing authenticated remote attackers to disclose sensitive information. The vulnerability affects all versions of the SDK and requires valid user credentials to exploit, making it a moderate-risk issue for organizations using Flare in multi-user environments. No public exploit code or active exploitation has been identified.
RemediationAI
Consult NVIDIA's official security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5819 for the exact patched version. Once a patch is released, upgrade Flare SDK to the fixed version immediately. As an interim mitigation for organizations unable to patch quickly, implement strict input validation on all file path parameters by employing allowlist-based path resolution (only permit access to explicitly approved directories), use chroot or containerization to limit file system scope accessible to the Flare process, restrict Flare SDK deployment to trusted networks with strict access controls, and audit access logs for unusual file operations. These compensating controls reduce but do not eliminate risk and should be considered temporary until patching is possible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NVIDIA Flare SDK is a federated learning framework that enables collaborative machine learning across distributed data sources. The vulnerability stems from CWE-20 (Improper Input Validation), specifically a path traversal flaw where user-supplied input is not properly validated before being used in file system operations. An attacker with valid credentials can manipulate file path parameters (such as directory or file name inputs) to traverse beyond intended boundaries (e.g., using '../' sequences) and access files outside the intended directory structure. This is a common pattern in web and distributed applications where input sanitization is insufficient.
Know when Flare Sdk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (nvidia) · only source for this CVE.
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA Flare SDK contains a vulnerability where an Attacker may cause an Improper Input Validation by path traversing. A successful exploit of this vulnerability may lead to information disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Authentication bypass in NVIDIA NVFlare Dashboard allows remote unauthenticated attackers to escalate privileges through
Remote code execution in NVIDIA FLARE SDK allows authenticated attackers to execute arbitrary code by sending maliciousl
GitHub PoC
Exploit-DB