NVIDIA AIStore CVE-2026-65162

Exploitation requires network reachability to the LEGACY ETL Kubernetes PodSpec initialization API in NVIDIA AIStore on Linux, and depends on that legacy ETL/transformation feature being enabled and exposed. The specific lever is attacker-supplied Kubernetes host-namespace settings (e.g. hostPID/hostNetwork/hostIPC) and container-security-context fields in the PodSpec. The vector is AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is needed against a default-reachable endpoint; the practical limiting factors are whether the ETL API is network-exposed, whether the legacy code path is in use, and the Kubernetes RBAC/PodSecurity constraints governing whether AIStore can actually schedule host-namespaced privileged pods - hardened PodSecurity admission policies would blunt the escape step.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes a network-reachable, low-complexity, unauthenticated flaw with scope change and total compromise of confidentiality, integrity, and availability - the worst possible profile. CWE-250 (execution with unnecessary privileges) is consistent with the description: the legacy ETL PodSpec API lets a remote caller dictate Kubernetes host-namespace and container-security settings, so an attacker can request a privileged/host-namespaced pod and break out to the node. The scope change (S:C) is well justified because compromise moves from the AIStore service to the underlying Kubernetes host. Signals are mutually reinforcing rather than conflicting: the CVSS vector and the CWE both point to privileged container escape. However, exploitation-likelihood telemetry is MISSING - no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis. The absence of EPSS/KEV data does not lower the intrinsic severity; it only means real-world exploitation volume is currently unmeasured. Treat as critical and patch urgently despite the lack of exploitation telemetry.

A remote attacker with network access to the AIStore ETL endpoint submits a crafted PodSpec initialization request that sets host-namespace flags (e.g. hostPID/hostNetwork) and permissive container-security context. AIStore schedules the attacker-controlled privileged pod, which escapes to the Kubernetes node and executes code with elevated privileges. No public exploit identified at time of analysis, so the scenario is inferred from the description and CVSS vector rather than a confirmed POC.