NVIDIA AIStore CVE-2026-65170

Exploitation requires the target AIStore deployment to have the EXPERIMENTAL HT backend enabled - this is the specific feature containing the flaw and is the primary limiting factor, as it is not a default/standard configuration. Given it, the attacker needs only network reachability to the AIStore service and the ability to supply a crafted 'original URL' value; no authentication (PR:N) and no user interaction (UI:N) are required. Impact is limited to information disclosure via server-side request forgery (C:H, I:N, A:N) - the attacker cannot directly modify data or cause denial of service. Realistic risk is therefore gated almost entirely on whether the experimental HT backend is turned on and whether the instance is network-exposed.

Signals are mostly consistent toward a serious but conditional network risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N = 8.6 High) describes an unauthenticated, low-complexity, remote vulnerability with a scope change and high confidentiality impact but no integrity or availability impact - fully aligned with the CWE-918 SSRF classification and the description's 'unauthenticated remote attacker … information disclosure.' However, the key mitigating signal is in the description itself, not the vector: the flaw resides in an EXPERIMENTAL HT backend, which is unlikely to be enabled in typical production deployments, so real-world exposure is narrower than the PR:N/AC:L vector implies. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public POC is indicated - so there is no evidence of active or imminent mass exploitation. Net: a genuinely high-severity SSRF worth prompt patching for anyone running the HT backend, but for most AIStore operators this is a lower practical priority because the affected code path is a non-default, experimental feature rather than a universally exposed surface.

An attacker who can reach an AIStore instance that has the experimental HT backend enabled sends a request containing a crafted 'original URL'; the server dereferences it, allowing the attacker to make the server issue requests to internal-only endpoints (e.g., cloud metadata services or internal APIs) and relay the responses back, disclosing sensitive internal information. No authentication or user interaction is required per the CVSS vector. No public exploit code is identified at time of analysis.