NVIDIA AIStore CVE-2026-65172

Exploitation requires network reachability to an AIStore proxy endpoint exposing the ETL (Extract-Transform-Load) management API; the vulnerability is in the ETL management API's authorization handling (CWE-862), so any deployment using ETL job functionality is affected. Per the CVSS vector (PR:N/UI:N), no authentication, credentials, or user interaction are needed - remote unauthenticated exploitation against affected AIStore deployments. The primary limiting factor is network exposure: impact is confined to environments where the AIStore proxy is reachable by the attacker (e.g., exposed to untrusted networks or reachable from a compromised internal host) and where ETL jobs exist to enumerate and control. No special non-default product configuration is called out in the description.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw - the easiest possible exploitation profile - and the CWE-862 (missing authorization) root cause is consistent with that: there is no authentication gate on the ETL management API, so reaching an AIStore proxy over the network is effectively the only prerequisite. The impact split (C:H/I:L/A:L) is coherent with the description: full read access to ETL job information (confidentiality high) plus the ability to start/stop existing jobs (partial integrity and availability impact), which correctly stops short of C/I/A all-High because an attacker manipulates existing pipelines rather than achieving arbitrary code execution or full data destruction. No EPSS score, CISA KEV entry, or public POC was provided in the input, so predicted and observed exploitation signals are simply ABSENT rather than low - their absence should not be read as reassurance given how trivially exploitable the flaw is. The one signal to verify: the reference set contains only the NVIDIA product-security advisory stub, NVD, and CVE.org pages, so exploitation-maturity data is thin and the risk rating rests on the vector and description alone.

An attacker who can reach an exposed AIStore proxy on the network sends a crafted GET request to the ETL management API and receives information about running ETL jobs with no credentials. They then send a crafted POST request to stop or start those ETL jobs, disrupting or tampering with the victim's data-processing pipelines. No public exploit code was identified at the time of analysis, but the low attack complexity makes weaponization straightforward.