EUVD-2026-84409
GHSA-34c9-g45q-gppm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes an unauthenticated network-reachable authentication bypass (PR:N/UI:N/AV:N/AC:L) yielding privesc, disclosure, and tampering, mapping to C:H/I:H/A:H, though SSVC 'partial' impact suggests these may be conservative.
Primary rating from Vendor (nvidia).
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentication issue. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, and data tampering.
Articles & Coverage 3
AnalysisAI
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-84409) allows a remote, unauthenticated network attacker to bypass authentication and obtain privilege escalation, information disclosure, and data tampering with full confidentiality, integrity, and availability impact per the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 critical). No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV does not list this CVE); EPSS is 0.32% (25th percentile), and CISA's SSVC assessment rates exploitation as none, automatable as no, and technical impact as partial, indicating low near-term mass-exploitation likelihood. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to an installation of NVIDIA Infrastructure Controller for Linux at a version at or below 1.9; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed against a reachable instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 critical) describes a remotely reachable, low-complexity, unauthenticated authentication flaw with full confidentiality, integrity, and availability impact - a maximally severe profile on paper. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is specified in the provided data, so patch status is not confirmed at time of analysis; the primary action is to consult NVIDIA's advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5879 to obtain the fixed build and upgrade path for Infrastructure Controller versions 0 through 1.9, and to treat any version at or below 1.9 as vulnerable until that advisory states otherwise. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deployment of NVIDIA Infrastructure Controller for Linux at versions 0 through 1.9 and confirm that no instance is reachable from the internet or from untrusted network segments; restrict management-plane access to a dedicated administrative VLAN with allowlisted source IPs and require MFA on all administrative jump hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Infrastructure Controller
View allUnauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a netwo
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated rem
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) al
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path tha
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) l
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated att
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who alr
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who al
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-priv
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today