Summary
CVE-2026-65113 is a critical vulnerability in NVIDIA Infrastructure Controller for Linux caused by the use of hard-coded credentials (CWE-798). An unauthenticated network attacker who knows or discovers the embedded credential can gain unauthorized access to the controller, potentially leading to privilege escalation, data tampering, denial of service, and disclosure of sensitive information. NVIDIA rates this issue as CRITICAL with a CVSS v3.1 base score of 9.8.
Technical details
- Root cause: The affected NVIDIA Infrastructure Controller software contains one or more hard-coded (embedded) credentials within the product, as classified under CWE-798 (Use of Hard-coded Credentials).
- Trigger conditions: No authentication or user interaction is required; an attacker only needs network reachability to an exposed instance of the vulnerable service.
- Attack vector: Network (AV:N) with low attack complexity (AC:L) and no privileges required (PR:N), meaning the vulnerability can be exploited remotely without prior access to the system.
- Impact: Successful exploitation can result in escalation of privileges, tampering with data, denial of service, and unauthorized disclosure of information — the CVSS vector reflects high impact to confidentiality, integrity, and availability (C:H/I:H/A:H).
Affected software
- NVIDIA Infrastructure Controller for Linux — versions 0 through 1.9 (per NVIDIA’s official CVE record; all releases in this range are listed as affected, with the vendor’s default status for other versions listed as unaffected).
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Consult NVIDIA’s official security advisory (referenced below) for the specific patched release of Infrastructure Controller and upgrade to a fixed version as soon as it is available/confirmed by the vendor. At the time of publication, NVIDIA had not yet published the detailed advisory content for this CVE beyond the CVE record itself, so organizations should monitor the vendor’s advisory page for the patched build number.
- If no patch is yet available or cannot be applied immediately:
- Restrict network access to NVIDIA Infrastructure Controller management interfaces to trusted, segmented management networks only; do not expose the controller directly to the internet or untrusted networks.
- Apply firewall/ACL rules limiting inbound connections to the controller’s service ports to known administrative hosts.
- Monitor authentication and access logs on the controller for unexpected or anomalous access, particularly attempts using default or documented service accounts.
- Where supported, rotate or disable any credentials that may be shared or embedded in deployment images, and rebuild affected instances from a patched image once available.