External risk intelligence

NVIDIA AIStore Missing Authentication Vulnerability Allows Data Tampering and Denial of Service

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-65173

NVIDIA AIStore is an object storage system for AI data. While it includes network-accessible endpoints, it is typically deployed within controlled enterprise or research environments rather than being exposed directly to the public internet by design. While it is plausibly reachable from the internet in some deployments, the CVE context does not clearly establish that public exposure is common.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in NVIDIA AIStore for Linux. An unauthenticated attacker could potentially manipulate data or disrupt services by submitting specially crafted revocation lists. The main concern is to confirm if this technology is in use and, if so, to what extent it might be exposed.

Unauthenticated access could lead to data tampering.
Confirms exposure and relevance if AIStore is deployed.
Assess impact and initiate necessary verification steps.

Attack Path

How an attacker could exploit the issue

An unauthenticated remote attacker can target the NVIDIA AIStore for Linux by sending specially crafted requests to the token-revocation endpoint. This vulnerability allows attackers to interfere with system operations and potentially cause denial of service.

No authentication needed to reach endpoint.
Triggered by submitting crafted token-revocation lists.
Enables data tampering and denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in NVIDIA AIStore for Linux could allow an unauthenticated remote attacker to tamper with data or cause a denial of service by submitting crafted token-revocation lists to the token-revocation endpoint. This affects systems where the AIStore service is network-accessible without authentication.

Data/System: AIStore data integrity and service availability.
Exposure: Unauthenticated network access to token-revocation.
Consequence: Data corruption and service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

NVIDIA AIStore deployments require coordinated action from platform and security teams. Initial steps involve identifying all AIStore instances, assessing their network reachability and business criticality, and confirming ownership. Once accountable owners are identified, remediation can be planned based on the assessed risk.

Platform and security teams own the issue.
Verify AIStore instance reachability and criticality.
Plan remediation based on risk and ownership.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NVIDIA AIStore?

NVIDIA AIStore is an object storage system specifically designed for AI workloads. It allows researchers and engineers to manage, cache, and distribute the massive datasets required for training and deploying artificial intelligence models across distributed Linux environments.

What does CWE-306 mean for CVE-2026-65173?

CWE-306 refers to a Missing Authentication for Critical Function vulnerability. In this case, it means the software's token-revocation endpoint fails to verify who is making a request. Because authentication is bypassed, the system accepts malicious instructions as if they were legitimate, allowing unauthorized changes to the system's security tokens.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted token-revocation list directly to the affected endpoint. This action does not require the attacker to have valid user credentials or prior access to the system. Simply interacting with this specific network-accessible function is enough to initiate the disruptive sequence.

Does my AIStore deployment need to be internet-facing to be at risk?

While Halo Surface Signal notes that AIStore is typically housed in controlled research or enterprise environments rather than public internet spaces, any network path—internal or external—that can reach the service endpoint is a potential vector. If an attacker can communicate with the service over your local network, the risk remains relevant regardless of public internet exposure.

What should I do if I use NVIDIA AIStore?

First, locate and inventory every instance of AIStore running in your environment. Once identified, work with your security team to determine the network reachability of these instances. Assessing which systems can communicate with the token-revocation endpoint will help you prioritize further risk mitigation steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.