EUVD-2026-84410
GHSA-8879-h5jv-8jch
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable XML injection with low complexity but requiring authenticated low-privilege access (PR:L); no confidentiality impact (C:N), with high integrity/availability impact from data tampering and DoS.
Primary rating from Vendor (nvidia).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data tampering and denial of service.
AnalysisAI
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who already holds a low-privilege authenticated session to corrupt data and degrade availability by feeding crafted input into the product's XML handling. The flaw is network-reachable (AV:N), needs no user interaction (UI:N), and leaves confidentiality untouched (C:N), with the full impact landing on integrity and availability (I:H/A:H); the practical exposure is narrowed because valid credentials are mandatory, the target is a specialized NVIDIA datacenter infrastructure component, and SSVC rates the issue non-automatable with only partial technical impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to already hold low-privilege authenticated access (PR:L) to the NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9), reachable over the network (AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine medium-to-high priority issue but not an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The supplied data does not identify a fixed release version, so patch status must be confirmed directly against NVIDIA's advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5879 rather than assumed; until a fixed build is verified and deployed, treat the controller as unpatched and apply compensating controls. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all NVIDIA Infrastructure Controller for Linux deployments across versions 0 through 1.9 and confirm whether any are network-exposed; immediately restrict management access to trusted networks and review low-privilege accounts for unnecessary permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Infrastructure Controller
View allUnauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a netwo
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated rem
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) al
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-8440
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path tha
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) l
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated att
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who al
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-priv
Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today