Missing Auth in NVIDIA AIStore Token-Revocation Data Tampering & DoS
CVE-2026-65173 Published on October 13, 2026
NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.
Vulnerability Analysis
CVE-2026-65173 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity and availability.
Weakness Type
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Products Associated with CVE-2026-65173
Want to know whenever a new CVE is published for NVIDIA Aistore? stack.watch will email you.
