What is the CVSS score of EUVD-2026-24145?

EUVD-2026-24145 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

NVIDIA KAI Scheduler EUVD-2026-24145

| CVE-2026-24176 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-21 nvidia

GHSA-rpp2-m4j9-w728

Authentication Bypass Nvidia

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 21, 2026 - 17:01 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 16:30 euvd

EUVD-2026-24145

Analysis Generated

Apr 21, 2026 - 16:30 vuln.today

CVE Published

Apr 21, 2026 - 16:17 nvd

MEDIUM 4.3

DescriptionCVE.org

NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references. A successful exploit of this vulnerability might lead to data tampering.

AnalysisAI

NVIDIA KAI Scheduler contains an improper authorization vulnerability allowing authenticated attackers to reference pods across Kubernetes namespaces they do not own, enabling data tampering. The vulnerability requires valid credentials and network access to the scheduler but does not permit confidentiality breaches or denial of service. CVSS 4.3 (low) reflects authenticated access requirement and integrity impact only; no active exploitation or public POC identified.

Technical ContextAI

KAI Scheduler is NVIDIA's Kubernetes pod scheduling component. The vulnerability involves improper authorization controls (CWE-863) in cross-namespace pod reference handling. In Kubernetes, namespace isolation is a fundamental security boundary; pods should only reference resources within their own namespace unless explicitly authorized via RBAC policies. The flaw allows authenticated users (those with valid credentials to the cluster) to manipulate pod specifications to reference or tamper with pods in other namespaces, bypassing intended namespace isolation. This is a logic-layer authorization failure rather than a cryptographic or access-control-list implementation bug.

RemediationAI

Upgrade NVIDIA KAI Scheduler to the patched version identified in NVIDIA advisory https://nvidia.custhelp.com/app/answers/detail/a_id/5818 (exact version not confirmed from input data). As interim compensating controls, restrict RBAC permissions for service accounts and users running workloads to prevent cross-namespace pod creation or modification; audit pod specifications in all namespaces for unauthorized cross-namespace references; enable Kubernetes NetworkPolicies to restrict inter-namespace traffic if namespace isolation is enforced at network layer. Note that RBAC restrictions may reduce flexibility for legitimate multi-namespace orchestration workflows and should be tested before production deployment.