CVE-2026-65173 NVIDIA CVE debrief

Who should care

Defenders responsible for NVIDIA AIStore framework deployments on Linux, particularly those using versions 0 to 4.9, should assess exposure and prioritize verification and compensating controls.

Why it matters

Defenders should prioritize verifying exposure of AIStore framework versions 0 to 4.9 on Linux and assessing compensating controls due to the missing authentication vulnerability.

• Potential data tampering requires verification and mitigation
• Potential denial of service requires verification and mitigation
• Exposure of AIStore framework versions 0 to 4.9 on Linux requires verification
• Compensating controls may be necessary for affected systems

Technical summary

NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint. An unauthenticated remote attacker may submit crafted token-revocation lists, potentially leading to data tampering and denial of service. The vulnerability affects AIStore framework versions 0 to 4.9 on Linux, and defenders should prioritize verifying exposure and assessing compensating controls. The CVE record and NVD entry provide details on the missing authentication vulnerability in NVIDIA AIStore for Linux.

Defensive priority

Defenders should prioritize verifying exposure of AIStore framework versions 0 to 4.9 on Linux and assessing compensating controls.

Recommended defensive actions

• Verify AIStore framework versions 0 to 4.9 on Linux are exposed and assess compensating controls
• Review and update inventory to identify affected systems
• Implement additional authentication measures for token-revocation endpoints
• Monitor for suspicious activity related to crafted token-revocation lists
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the missing authentication vulnerability in NVIDIA AIStore for Linux. The vulnerability allows an unauthenticated remote attacker to submit crafted token-revocation lists, potentially leading to data tampering and denial of service.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.