EUVD-2026-84418
GHSA-m2fq-f459-9586
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Missing authentication (CWE-306) on a network-reachable critical function yields unauthenticated low-complexity access (AV:N/AC:L/PR:N/UI:N); description's tampering, DoS, and disclosure support C:H/I:H/A:H.
Primary rating from Vendor (nvidia).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.
Articles & Coverage 3
AnalysisAI
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows remote, unauthenticated attackers to reach a privileged operation without credentials, enabling data tampering, denial of service, and information disclosure. The vendor-assigned CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), and the independent assessment concurs, meaning no authentication, no user interaction, and no special complexity are required against a network-reachable instance; the practical limiting factor is exposure, since this is a specialized AI/HPC datacenter management component usually confined to internal management networks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to an NVIDIA Infrastructure Controller for Linux instance running an affected version (0 through 1.9) that exposes the vulnerable critical function; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, no user interaction, and no special complexity are needed against a reachable instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a maximum-severity flaw on paper: the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes remote, unauthenticated, low-complexity exploitation of a missing-authentication weakness (CWE-306) with full confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so the primary action is to consult the NVIDIA product-security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5879 and apply the vendor-designated fixed release for NVIDIA Infrastructure Controller for Linux 0 through 1.9 as soon as it is confirmed for your deployment; do not assume a specific version number until NVIDIA publishes it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of NVIDIA Infrastructure Controller for Linux across versions 0 through 1.9, confirm which instances are reachable from untrusted or broadly routed networks, and immediately block inbound access to the controller's management interface at the firewall and load-balancer layers so that only explicitly approved administrative hosts and jump servers can connect; enable verbose authentication and configuration-change logging on all remaining reachable instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Infrastructure Controller
View allUnauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a netwo
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated rem
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-8440
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path tha
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) l
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated att
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who alr
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who al
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-priv
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today