EUVD-2026-84421
GHSA-g3hv-53xc-3r85
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Certificate-validation bypass requires an MITM/on-path position, so AC:H rather than AC:L; no privileges or user interaction needed, and successful interception enables confidentiality, integrity, and availability impact.
Primary rating from Vendor (nvidia).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
Articles & Coverage 3
AnalysisAI
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an attacker who occupies an on-path / man-in-the-middle position on the controller's network path to present a forged, mismatched, or otherwise invalid certificate that the product wrongly accepts, enabling information disclosure, data tampering, and denial of service. NVIDIA's advisory assigns a 9.8 CVSS 3.1 base score (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but independent assessment lowers the real-world severity to AV:N/AC:H because the attacker must first intercept or redirect the controller's TLS traffic, and CISA's SSVC decision framework records Exploitation: none, Automatable: no, and Technical Impact: partial. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to occupy a man-in-the-middle / on-path position on a TLS connection made or accepted by NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9), because the flaw is improper certificate validation (CWE-295) - the attacker must present a forged, mismatched, or otherwise invalid certificate that the controller wrongly accepts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) presents this as a maximally critical, trivially exploitable network flaw, but multiple corroborating signals argue for a materially lower real-world priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed version is specified in the available data, so the authoritative action is to consult NVIDIA's advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5879 and apply the vendor-designated release for the affected 0-through-1.9 range as soon as it is published; deployment owners should subscribe to that repository for the corrected build identifier rather than assume any version in the vulnerable range is safe. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of NVIDIA Infrastructure Controller for Linux versions 0 through 1.9 and isolate them from untrusted networks, restricting management and TLS peer communication to dedicated management VLANs or encrypted transport with strict allowlists; also confirm there is no vendor-released patch identified at time of analysis and open a tracking ticket with NVIDIA. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Infrastructure Controller
View allUnauthenticated OS command injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a netwo
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated rem
Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) al
Improper authentication in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9, tracked as EUVD-2026-8440
NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) can be induced to operate on a file name or path tha
SQL injection in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows a remote attacker who holds
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) l
Hard-coded credentials in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) let an unauthenticated att
Improper TLS certificate validation in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) allows an att
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who alr
Denial of service in NVIDIA Infrastructure Controller for Linux affects versions 0 through 1.9, where an attacker who al
Denial of service in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated, low-priv
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today