External risk intelligence

NVIDIA AIStore Linux ETL API Allows Remote Code Execution and Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-65162

The vulnerability exists in a Kubernetes PodSpec initialization API within NVIDIA AIStore. While Kubernetes APIs are typically intended for internal cluster management and restricted access, they are occasionally exposed or misconfigured in cloud-native environments. Because the context does not confirm this specific API is standardly exposed to the public internet, a score of Possible is assigned.

Privilege Escalation

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in NVIDIA AIStore for Linux, specifically within its legacy Kubernetes PodSpec initialization API. The issue allows remote attackers to manipulate host-namespace and container-security settings, potentially leading to severe consequences including code execution, privilege escalation, information disclosure, data tampering, and denial of service. While the vulnerability is severe, its direct impact depends on how this specific API is configured and accessed within your environment.

Unsecured API allows remote system compromise.
Critical vulnerability could affect core operations.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a vulnerability in NVIDIA AIStore's legacy ETL Kubernetes PodSpec initialization API. This API allows for the configuration of host-namespace and container-security settings. By supplying malicious settings, an attacker could potentially gain control of the system, leading to severe consequences.

Entry condition: Unauthenticated network access.
Trigger point: Supplying Kubernetes host-namespace settings.
Resulting risk: Code execution and data tampering.

Live Threat

Current exploitation, exposure, and threat context

NVIDIA AIStore for Linux, when using the legacy ETL Kubernetes PodSpec initialization API, could be subject to an attack where a remote attacker might provide specific Kubernetes host-namespace and container-security settings. This could potentially lead to unauthorized code execution, increased privileges, disclosure or alteration of data, and service disruptions.

System data and service behavior.
Attacker supplies malicious settings.
Code execution and data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the vulnerability in NVIDIA AIStore for Linux affecting its Kubernetes PodSpec initialization API, platform or infrastructure teams managing Kubernetes environments are likely responsible for addressing this. The first practical step involves identifying all AIStore instances, confirming their network reachability and criticality to business operations, and then locating the specific team or individual accountable for these assets to plan a coordinated remediation.

Platform/Infrastructure teams own remediation.
Verify AIStore deployment reachability.
Plan risk-based response actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NVIDIA AIStore?

NVIDIA AIStore is a storage software solution for Linux designed to handle high-performance data workloads. It often integrates with Kubernetes environments to manage data processing tasks, including ETL (Extract, Transform, Load) pipelines that prepare large datasets for AI training and analysis.

What does CWE-250 mean for CVE-2026-65162?

CWE-250 refers to 'Execution with Unnecessary Privileges.' In this vulnerability, the legacy ETL API fails to restrict inputs, allowing an attacker to supply configuration settings that grant the software more power than it should have, such as modifying container security or accessing host-level namespaces.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending malicious parameters to the legacy ETL Kubernetes PodSpec initialization API. It is important to note that sending standard, non-malicious API requests or attempting to interact with other parts of the AIStore platform that do not utilize this specific legacy PodSpec initialization function will not activate the vulnerability.

Is my system at risk?

Halo Surface Signal classifies this as 'Possible' risk. While Kubernetes APIs are usually protected within internal networks, they can be accidentally exposed to the internet via misconfiguration. You should check if this specific legacy API is reachable from outside your protected environment to determine your actual exposure level.

How should I respond to this threat?

First, identify all instances of NVIDIA AIStore running in your Kubernetes clusters. Determine if the legacy ETL API is active and whether it is accessible from your network perimeter. Once identified, work with your infrastructure or platform engineering team to prioritize and coordinate a risk-based remediation plan.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.