EUVD-2026-84412
GHSA-qcj9-72c7-qh5m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L (authenticated low-priv) and AC:H because CWE-841 needs crafted out-of-order/state manipulation; SSVC 'partial' and hedged description support uniformly Low C/I/A, not High.
Primary rating from Vendor (nvidia).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.
AnalysisAI
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated low-privilege user on the management plane drive the product's API with out-of-order or state-skipping requests that defeat intended workflow checks, with possible data tampering, denial of service, and information disclosure. Exploitation is not remote-unauthenticated: it requires a valid low-privilege account plus the ability to craft non-sequential workflow calls, and SSVC records Exploitation as 'none' and Automatable as 'no', so there is no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated low-privilege account (PR:L) on the NVIDIA Infrastructure Controller for Linux management plane and the ability to drive its API/workflow with crafted out-of-order or state-skipping requests that defeat behavioral-workflow enforcement (CWE-841). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals point to a real-but-moderate issue, not a top-tier emergency, and they partially conflict. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed release is confirmed by the supplied data, so treat the NVIDIA product-security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5879 as the authoritative source and apply the vendor-designated fixed Infrastructure Controller build as soon as it is published, then verify the running controller version rather than assuming an upgrade covered it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all NVIDIA Infrastructure Controller for Linux deployments, confirm whether any instance is running versions 0 through 1.9, and restrict management-plane access to trusted administrative networks and accounts; review API and audit logs for out-of-order or state-skipping workflow calls and preserve evidence. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Infrastructure Controller
View allUnauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a netwo
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated rem
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) al
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-8440
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path tha
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated att
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who alr
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who al
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-priv
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today