NVIDIA OpenShell CVE-2026-65092

The attacker must hold low-privilege authenticated access to the L7 REST policy enforcement layer of NVIDIA OpenShell Sandbox, as confirmed by CVSS PR:L - unauthenticated external parties cannot directly exploit this vulnerability without first obtaining credentials or a valid session token. The L7 REST network policy feature must be active and configured to restrict specific endpoint paths for the bypass to yield meaningful access (a deployment with no path-based restrictions would have no policy boundary to circumvent). Exploitation is fully remote and requires no user interaction (AV:N, UI:N), so no victim action is needed once authentication is obtained. Limiting factors: the PR:L credential requirement constrains opportunistic exploitation; the actual impact ceiling depends on the sensitivity of REST resources protected behind the bypassed policy, not the vulnerability itself; and the flaw is Linux-specific per the product description.

The CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) is the dominant quantitative signal available and accurately reflects the exploit conditions: network-reachable, low attack complexity, and a scope change that elevates effective impact beyond the sandbox perimeter. The Changed Scope metric is the most operationally significant element - it means the enforcement boundary itself is the target, and a successful bypass exposes downstream REST resources that were never intended to be accessible to the attacker's privilege tier. EPSS data is not present in available sources, and the vulnerability is absent from the CISA KEV catalog, so no confirmed widespread or targeted exploitation has been established. No public POC has been identified, which lowers immediate opportunistic risk. However, the exploit class - path traversal against a policy enforcement point - is well-understood, mechanically simple, and trivially probeable by automated scanners. The primary realized risk is unauthorized information disclosure from protected REST backends; the secondary risk (data tampering, I:L) is bounded by whatever write semantics the downstream REST service exposes. Deployments in multi-tenant environments or those where the sandbox policy is the primary access control boundary face the highest practical exposure.

A low-privileged user or service account with network access to an OpenShell-protected environment crafts an HTTP request to a REST endpoint that network policy restricts, embedding path traversal sequences (e.g., URL-encoded '../' segments) in the request path. The L7 policy enforcement engine evaluates the raw traversal path against its rules, finds no match for the restricted endpoint, and permits the request; the upstream REST service then resolves the canonical path and returns protected data. The attacker iterates across traversal-obfuscated paths to enumerate and exfiltrate information from resources that the policy was configured to isolate from their privilege tier.