NVIDIA AIStore EUVD-2026-98553

Exploitation targets the target-side (storage node) object rename handler of NVIDIA AIStore on Linux; the attacker must be able to send requests directly to an AIStore target node and supply a crafted rename destination path that traverses outside the intended restricted directory. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N). The principal limiting factor is AC:H: the attacker needs direct network reachability to a target node (not just the front-end proxy) and must construct a traversal payload that the rename handler accepts - this constrains realistic exploitation to environments where target nodes are network-accessible to the attacker (e.g., flat cluster networks or exposed target ports).

This is a genuinely serious but non-trivial-to-exploit vulnerability. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1 HIGH) shows a network-reachable, unauthenticated (PR:N) flaw requiring no user interaction, with full triad impact. The single mitigating signal in the vector is AC:H (high attack complexity), reflecting that the attacker must submit a crafted rename destination directly to an AIStore target node rather than through the normal proxy/gateway path, and must construct a traversal payload that escapes the restricted directory. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a vendor-disclosed (NVIDIA PSIRT) issue, not a widely-weaponized one. The signals are internally consistent: a high-but-not-critical CVSS with AC:H and no exploitation telemetry points to a real priority for organizations running AIStore, but not an emergency 'patch-tonight' event absent exploit-in-the-wild evidence. Note the C:H/I:H/A:H and the description's chain of consequences (code execution, privilege escalation, info disclosure, tampering, DoS) are characterized by the vendor as what a successful exploit 'might lead to' - the directly confirmed primary impact is arbitrary file creation/overwrite; the downstream RCE/disclosure/DoS outcomes are plausible escalations, not independently confirmed.

An attacker with network reachability to an AIStore target node (e.g., inside an ML/AI cluster network or an exposed target port) sends a crafted object-rename request whose destination path uses traversal sequences to escape the intended bucket directory. The write lands at an attacker-chosen location on the target host, overwriting a configuration file, script, or binary that is later executed, pivoting file-write primitive into code execution or denial of service. No authentication or user interaction is required, though the attacker must reach the target directly and craft a working traversal payload (AC:H); no public exploit code is known at this time.