EUVD-2026-66101
GHSA-2mfx-8qw9-7hfh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low privileges
-
DeliveryReach sandbox provisioning API
-
ExploitSubmit input missed by deny-list
-
ExecutionBypass sandbox validation
-
PersistEscape sandbox / execute code on host
-
ImpactEscalate privileges or disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation completeness
|
| Exploitation Conditions | Exploitation requires network access to the NVIDIA OpenShell sandbox provisioning API and low-level authenticated privileges (CVSS PR:L) - it is not exploitable by a fully unauthenticated remote party. The specific trigger is submitting inputs that fall outside OpenShell's incomplete disallowed-input list for the provisioning API, so the attacker must reach and interact with that particular API surface. Limiting factors: an attacker must already possess valid low-privilege credentials/access, and must know or discover which disallowed inputs the deny-list fails to cover; no user interaction is required (UI:N) and attack complexity is low (AC:L), so once those access prerequisites are met the barrier is small. |
| Impact | The CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network-reachable, low complexity, only low privileges required, no user interaction, with a scope change and full CIA impact - a genuinely high-severity profile. However, mitigating real-world-risk signals are weak or absent: there is no EPSS score in the input, the CVE is not in CISA KEV (no confirmed active exploitation), and no public POC is referenced, so this is high-potential-severity rather than proven-widespread-exploitation. The PR:L requirement means an attacker must already hold some authenticated foothold, which limits opportunistic mass exploitation. Note a caveat: the scope-change/full-impact rating implies a sandbox-escape-to-host outcome, but the terse vendor description ('might lead to code execution... denial of service') does not detail the escape mechanics - treat the exact impact chain as vendor-asserted rather than independently verified. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to an OpenShell deployment sends crafted requests to the sandbox provisioning API using input values omitted from the incomplete disallow-list. The malformed input bypasses validation and manipulates sandbox provisioning, escaping the isolation boundary to run code or tamper with data on the host. No public POC is referenced, so an attacker would need to derive the bypass independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Privilege escalation and remote code execution in NVIDIA OpenShell for Linux stem from an incomplete deny-list in its sandbox provisioning API, letting an authenticated attacker submit inputs that were meant to be blocked but were not. Because the flaw crosses the sandbox boundary (CVSS scope change), a successful exploit can yield code execution, privilege escalation, information disclosure, data tampering, and denial of service against the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
RemediationAI
Consult NVIDIA product-security advisory 5872 (https://github.com/NVIDIA/product-security/tree/main/2026/5872) and upgrade OpenShell to the fixed release it names; an exact patched version number is not present in the provided input, so treat this as 'patch available per vendor advisory' and confirm the target build directly from that bulletin. Until patched, restrict who can reach the sandbox provisioning API - because exploitation needs authenticated (PR:L) network access, tightening authentication and network-segmenting the API endpoint (allow only trusted management hosts) directly reduces exposure, at the cost of constraining legitimate remote automation. Additionally, monitor and rate-limit provisioning requests and audit inputs to the API for anomalous values, accepting that this is detective/compensating control only and does not close the deny-list gap.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is NVIDIA OpenShell's sandbox provisioning API (CPE cpe:2.3:a:nvidia:openshell). The root cause is CWE-184 (Incomplete List of Disallowed Inputs): the API validates requests against an enumerated set of forbidden inputs rather than an allow-list, and that deny-list is incomplete, so certain malicious or unexpected inputs pass validation. Deny-list validation is inherently fragile because it must anticipate every dangerous value; missed cases here reach sandbox provisioning logic, where a bypass can influence what the sandbox is permitted to do and break the isolation boundary it is meant to enforce.
Know when Openshell gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable provisioning API with low-privilege auth (PR:L) and no user interaction; a sandbox-escape crosses the isolation boundary (S:C) yielding full code-execution impact (C/I/A:H).
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disallowed inputs. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service.
Articles & Coverage 2
Executive ViewAI
NVIDIA OpenShell for Linux contains a critical vulnerability (CVSS 9.9) allowing authenticated attackers to bypass sandbox protections and execute arbitrary code with system privileges. Successful exploitation enables complete system compromise including privilege escalation, data theft, unauthorized modification, and denial of service. Organizations deploying OpenShell in environments with user access face severe risk to system security and must implement urgent compensating controls.
Restrict authenticated access to OpenShell through access control lists limiting eligible users; disable OpenShell on systems where operationally unnecessary; implement network segmentation to prevent unauthorized access attempts; maintain detailed logging and real-time alerting for authentication events and execution activity; deploy endpoint detection and response (EDR) capabilities to detect post-exploitation compromise indicators; no public exploit identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Sandbox escape in NVIDIA OpenShell for Linux lets a low-privileged actor already operating inside the sandbox break its
OS command injection in NVIDIA OpenShell across all supported platforms allows a network-accessible malicious gateway to
Path traversal in NVIDIA OpenShell Sandbox for Linux permits low-privileged network-authenticated attackers to bypass L7
OS command injection in NVIDIA OpenShell for Linux's sandbox exec handler allows a low-privileged, network-accessible at
Improper output encoding in NVIDIA OpenShell's inference proxy on Linux allows a local low-privileged attacker to cause
Exploit-DB