This vulnerability allows an attacker to call KAI Scheduler API endpoints without authentication, meaning an unauthenticated actor can retrieve data that the scheduler exposes. The flaw is based on improper authentication handling (CWE-306) and, if exploited, can result in the unintended disclosure of internal scheduler information to unauthorized users.

NVIDIA KAI Scheduler is the affected product. No specific version range is listed; any version of the scheduler that has not been updated by NVIDIA after the advisory is considered vulnerable.

The vulnerability carries a CVSS score of 7.7, indicating high severity. While EPSS is not available, the lack of a mitigation or workaround suggests that the opportunity for exploitation exists, especially in environments where the scheduler APIs are exposed to an untrusted network or lack strict access controls. The likely attack vector is a direct network connection to the API endpoints; the attacker does not need privileged credentials to access them.