CVE-2026-65172

HIGH8.6

Published 2026-10-13 · Source psirt@nvidia.com

Description

NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

CWE-862

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-95680
IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.
2026-10-13 · score 8.0
CVE-2026-93907
IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.
2026-10-13 · score 8.1
CVE-2026-74045
Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.
2026-10-13 · score 7.1
CVE-2026-74037
Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.
2026-10-13 · score 7.2
CVE-2026-74036
Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.
2026-10-13 · score 7.2