Skip to content
AI Security Wire

Published

- 4 min read

By

NVIDIA Patches CVSS 10.0 Flaw in AIStore AI Data Platform

NVIDIA AIStore CVE-2026-65162 vulnerability management
img of NVIDIA Patches CVSS 10.0 Flaw in AIStore AI Data Platform

NVIDIA pushed out a fix on October 13 for a maximum-severity flaw in AIStore, its object storage framework built to feed data into AI and deep learning pipelines. The headline bug, CVE-2026-65162, carries a CVSS score of 10.0, the rare perfect score that means no privileges, no user interaction, and no real barrier standing between a remote attacker and full compromise.

The bulletin isn’t a one-off either. NVIDIA shipped it alongside seven other AIStore CVEs in the same disclosure, plus a separate bulletin for NVSentinel released the same day. For a company whose software now sits underneath a huge share of enterprise AI training infrastructure, a cluster of flaws like this in a core data-pipeline component is worth paying attention to even without evidence of active abuse yet.

What’s actually broken

The critical issue lives in AIStore’s legacy ETL Kubernetes PodSpec initialization API. According to NVIDIA’s own advisory, a remote attacker can supply Kubernetes host-namespace and container-security settings through that API without authenticating first. Get that wrong and you’re not just manipulating a storage job, you’re potentially handing an attacker a path to code execution, privilege escalation, data tampering, and denial of service, all from one unauthenticated request. It’s classified as CWE-250, execution with unnecessary privileges, which is about as direct a description of “this shouldn’t have been exposed like this” as CWE taxonomy gets.

The rest of the batch reads like a checklist of classic web and API security mistakes, just relocated into an AI storage system:

  • CVE-2026-65173 (CVSS 9.1): the token-revocation endpoint has no authentication at all, so an attacker can submit crafted revocation lists and tamper with data or knock the service offline.
  • CVE-2026-65172 (CVSS 8.6): missing authorization on the ETL management API lets an unauthenticated caller view or start/stop existing ETL jobs with a plain GET or POST.
  • CVE-2026-65170 and CVE-2026-65101 (both CVSS 8.6): server-side request forgery bugs, one in an experimental HT backend and one in the distributed sort component, both reachable by handing the service a crafted URL.
  • CVE-2026-65164 and CVE-2026-65103 (both CVSS 8.1): path traversal flaws, one in dSort’s archive extraction and one in the target-side object rename handler, that allow arbitrary file creation or overwrite.
  • CVE-2026-65161 (CVSS 7.5): the Promote API will read files accessible to the target process if handed a crafted absolute path, leaking data an attacker shouldn’t see.

Every one of these affects AIStore versions 0 through 4.9 on Linux. NVIDIA’s fix is version 5.0, available now from the project’s GitHub repository.

Why this cluster matters

Individually, a few of these would be unremarkable medium-to-high findings. Together, they describe a system where core management and data-movement endpoints were built with an implicit trust assumption: that nothing outside the cluster would ever talk to them directly. That assumption breaks the moment an AIStore proxy or target node ends up reachable from outside its intended network, which happens more often than anyone running the infrastructure would like to admit, especially in fast-moving ML ops environments where storage endpoints get provisioned ahead of the network policy that’s supposed to lock them down.

NVIDIA credits the bulk of the findings to independent researchers and TrendAI’s Zero Day Initiative, including Habibullo Izzatilloyev, Mat Powell, Mohamed Lemine Ahmed Jidou, and a small group working under TecSecurity. That’s consistent with how a lot of AI infrastructure vulnerability research gets done right now: specialist bug-hunting outfits treating ML pipeline software as a first-class target rather than an afterthought bolted onto a cloud deployment.

NVIDIA’s own disclaimer is worth repeating here too: its CVSS scoring reflects an average across diverse installations and “might not represent the true risk” to any specific deployment. For AIStore operators, that’s a nudge to actually check how their own instance is configured rather than assuming the published score tells the whole story.

What to do

Upgrade to AIStore 5.0. If that can’t happen immediately, keep proxy and target nodes off public networks, lock down access to the ETL management API, and disable or restrict the legacy ETL Kubernetes PodSpec initialization path until the patch lands. There’s no indication anyone is exploiting these yet, but a CVSS 10.0 in a data pipeline component that regularly touches training data isn’t something to leave on the patch backlog.

References

Frequently Asked Questions

What is NVIDIA AIStore and why does a flaw in it matter for AI security?
AIStore is NVIDIA's open-source, lightweight object storage system built specifically to feed large-scale AI and deep learning pipelines, including ETL jobs that preprocess training data on its way to GPU clusters. A remote code execution flaw in that layer sits upstream of the model training and inference pipeline, so a compromise there can taint data before it ever reaches a GPU.
Is CVE-2026-65162 being exploited in the wild?
No. As of this writing, NVIDIA's bulletin and third-party vulnerability trackers report no confirmed in-the-wild exploitation and no public proof-of-concept exploit for CVE-2026-65162. CISA's Known Exploited Vulnerabilities catalog does not list it.
What should AIStore operators do right now?
Upgrade to AIStore 5.0, which NVIDIA has published on the project's GitHub repository. Until the upgrade is complete, keep AIStore proxy and target nodes off public networks, restrict access to the ETL management API, and avoid enabling the legacy ETL Kubernetes PodSpec initialization path on internet-facing deployments.