EUVD-2026-98557
GHSA-482h-785m-c8c6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach AIStore cluster API
-
DeliverySubmit dsort job with crafted key-map URL
-
ExploitServer fetches attacker-controlled URL (SSRF)
-
ExecutionAIStore relays internal service response
-
ImpactDisclose internal/metadata information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to submit a distributed-sort (dsort) job to the AIStore cluster and to control the external key-map URL parameter for that job; the attacker sets that URL to an internal/restricted target to coerce a server-side fetch. Limiting factors: the attacker must have network reachability to the AIStore cluster/proxy API endpoint, and must be able to initiate a dsort operation - if the cluster API is firewalled, placed behind authentication, or egress from AIStore nodes to internal/metadata services is network-restricted, realistic exploitability drops significantly despite the PR:N rating. Impact is limited to confidentiality (information disclosure); no integrity or availability impact is indicated. |
| Impact | CVSS 3.1 base score is 8.6 (High) driven by a network vector (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and a scope change (S:C) with high confidentiality impact (C:H, I:N, A:N) - consistent with a classic SSRF (CWE-918) where the vulnerable AIStore node is coerced into reaching systems it should not. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or automated weaponization; the elevated score reflects theoretical reachability and impact, not observed in-the-wild activity. One point of tension to verify: the vendor rates PR:N (unauthenticated), yet triggering the flaw requires submitting a distributed-sort job with a crafted external key-map URL, which in most deployments presupposes reachability of (and ability to submit jobs to) the AIStore cluster API - if that API is network-restricted or authenticated in practice, real-world exploitability is narrower than PR:N implies. Net: a credible, vendor-confirmed High-severity SSRF worth patching, but in the absence of EPSS/KEV/POC signals it is a prioritize-on-exposure issue rather than a confirmed urgent threat. |
| Exploit ScenarioDerived | An attacker who can submit a distributed-sort job to an exposed AIStore cluster supplies a crafted external key-map URL pointing at an internal-only service (e.g., a cloud metadata endpoint or an internal API). The AIStore server fetches that URL server-side and returns or leaks the response content, disclosing internal data the attacker could not otherwise reach. No public exploit code is identified at time of analysis, so this would require custom tooling against the dsort API. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Server-side request forgery in NVIDIA AIStore for Linux's distributed sort (dsort) component allows remote unauthenticated attackers to make an AIStore node issue outbound HTTP requests to an arbitrary URL by supplying a crafted external key map URL, resulting in disclosure of information from internal or otherwise unreachable services. The CVSS 3.1 base score is 8.6 (High) via AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, meaning the attack is network reachable, low complexity, requires no privileges and no user interaction, with the impact limited to confidentiality (integrity and availability are unaffected). At time of analysis no public exploit code has been identified, there is no CISA KEV listing for this CVE, and no EPSS score was supplied in the available data.
RemediationAI
No vendor-released patch version is identified in the available advisory data, so remediation must be driven by the NVIDIA PSIRT advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5889, which should be monitored and applied as soon as a fixed AIStore build is published. In the interim, the highest-value control is to prevent the server-side fetch from reaching unintended targets: place the AIStore proxy/dsort API behind authentication and restrict network reachability to trusted clients only, since the supplied CVSS vector rates the issue as unauthenticated (PR:N) and the rating drops sharply once the API is firewalled or authenticated. Where feasible, disable or blocklist the external key map URL feature for dsort jobs and require key maps to be supplied inline or from local/cluster storage; this removes the vulnerable code path entirely but removes the ability to host key maps remotely. If external key maps cannot be disabled, enforce an allowlist of permitted schemes and hosts (and pin resolution to the validated IP) so that requests to loopback, link-local, RFC1918 and cloud metadata ranges (e.g. 169.254.169.254) are refused; this has a maintenance cost and can be bypassed by DNS rebinding or redirects if the validation is not applied after every redirect. Finally, apply egress network policy on AIStore nodes so they can only originate traffic to required object-storage and dependency endpoints, which limits the blast radius of any SSRF pivot, with the trade-off that legitimate cross-cluster or external fetches must be explicitly permitted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NVIDIA AIStore is a distributed, Go-based object storage system, and its distributed sort (dsort) subsystem reorganizes objects across the cluster using a key map that maps object names to output shards. That key map can be supplied as an external resource fetched over HTTP from a user-provided URL, and the server performs the fetch itself rather than validating or constraining the destination. This is a classic CWE-918 server-side request forgery: because the destination host, scheme, port and DNS resolution are attacker-influenced, the AIStore node can be coerced into reaching loopback interfaces, cloud instance metadata endpoints (e.g. 169.254.169.254), internal management APIs, or otherwise non-routable services that are only reachable from within the AIStore node's network position, and the fetched content can flow back through the job's error/response handling. The CVSS vector contains PR:N, confirming the documented prerequisite is unauthenticated access to the cluster's proxy/dsort API; the S:C scope change is consistent with the vulnerable AIStore component being used to reach and affect resources outside its own security authority, while the C:H/I:N/A:N profile matches a read-only SSRF that exfiltrates data but does not alter or disrupt the targeted services. No CPE strings were included in the supplied data, so exact affected build ranges could not be pinned down from the inputs alone.
Know when Nvidia gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-reachable dsort SSRF with low complexity; PR:N per vendor though job submission may need API access; scope changes to internal systems (S:C) yielding high confidentiality disclosure, no I/A impact.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
DescriptionCVE.org
NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key map URL. A successful exploit of this vulnerability might lead to information disclosure.
Articles & Coverage 1
Executive ViewAI
NVIDIA AIStore for Linux deployments that expose the distributed sort (dsort) component are exposed to CVE-2026-65101, a High-severity (CVSS 8.6) server-side request forgery flaw that a remote, unauthenticated attacker can trigger with a single crafted request. Because no credentials or user interaction are required, any reachable AIStore node can be turned into a pivot point for reaching internal-only services and data that leadership may assume are protected by network boundaries. No vendor patch or public exploit code is currently available, so near-term risk must be managed through configuration hardening and network controls.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or restrict the dsort external key map URL capability, enforce default-deny egress allowlisting on AIStore nodes, network-segment AIStore away from internal services and cloud metadata endpoints, and monitor outbound HTTP traffic for unauthorized destinations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary c
The NVIDIA driver before 307.78, and Release 310 before 311.00, in the NVIDIA Display Driver service on Windows does not
NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially craft
Authentication bypass in NVIDIA Triton Inference Server allows unauthenticated remote attackers to reach protected funct
NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially craft
NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default co
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA GeForce Experience R340 before GFE 2.11.4.125 and R375 before G
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and includ
The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privi
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with de
Exploit-DB