NVIDIA AIStore API Missing Auth: Unauthenticated ETL Discovery & Control
CVE-2026-65172 Published on October 13, 2026
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.
Vulnerability Analysis
CVE-2026-65172 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-65172 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-65172
Want to know whenever a new CVE is published for NVIDIA Aistore? stack.watch will email you.
