NVIDIA AIStore CVE-2026-65173

Exploitation requires network access to the AIStore token-revocation endpoint, which per the CVSS vector (AV:N/PR:N/UI:N) needs no authentication, no privileges, and no user interaction - the missing authentication control (CWE-306) is the defect itself, so an exposed endpoint on a default-reachable deployment is sufficient. The concrete prerequisite is the ability to send crafted token-revocation list requests to this endpoint; the primary LIMITING factor is network exposure - clusters that firewall or segment the AIStore management/control interface from untrusted networks substantially reduce reachability. Affected-version and default-exposure specifics are not stated in the available data and should be confirmed against NVIDIA advisory 2026/5889.

All available signals point to a genuine high-priority issue rather than an inflated CVSS score. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, consistent with the CWE-306 (Missing Authentication for Critical Function) root cause on the token-revocation endpoint. Impact is scored C:N/I:H/A:H, meaning no confidentiality loss but severe integrity (data tampering via crafted revocation lists) and availability (denial of service) damage - the 9.1 score is well-founded. However, several decision signals are MISSING from the input: no EPSS exploitation-probability score, no CISA KEV listing, and no indication of public POC code, so there is no public exploit identified at time of analysis. The absence of EPSS/KEV does not lower the intrinsic severity but means real-world exploitation volume cannot be quantified from this data; SSVC inputs (automatable, exploitation state) are also absent. Net: treat as a high-priority patch target given the trivial exploit preconditions, while noting that observed-exploitation telemetry is unavailable to confirm active abuse.

A remote attacker with network reachability to an AIStore cluster's token-revocation endpoint submits a crafted token-revocation list without any authentication. Because the endpoint does not verify the caller's identity, the attacker can revoke legitimate tokens or inject tampered revocation data, disrupting access (denial of service) and corrupting authorization state (data tampering). No public exploit code has been identified at time of analysis, but the low attack complexity makes weaponization straightforward.