CVE-2026-24178

Unauthenticated Authorization Bypass via User‑Controlled Key in NVIDIA FLARE Dashboard

View on CVE.org
Published Apr 28, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service.

Analysis

AI-generated

Technical impact

The vulnerability in NVIDIA’s NVFlare Dashboard allows an unauthenticated attacker to bypass the authorization mechanism through a user‑controlled key. This bypass can be leveraged to gain elevated privileges, tamper with data, disclose sensitive information, execute arbitrary code, or disrupt service availability.

Affected Systems

NVIDIA FLARE SDK is affected by this flaw.

Risk and Exploitability

The CVSS score of 9.8 indicates a high‑risk vulnerability, and the EPSS score is not available, suggesting that the exploitation likelihood is uncertain but potentially significant. It is not listed in the CISA KEV catalog. Because the description explicitly states that an unauthenticated attacker can achieve an authorization bypass, the likely attack vector involves manipulating user‑controlled input (e.g., a key) supplied via the dashboard’s authentication interfaces, though the precise method is not detailed in the available data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official vendor patch for NVIDIA FLARE SDK as soon as it becomes available
  • Restrict access to the dashboard by placing it behind a firewall or network segment that enforces strict authentication and network access policies
  • Ensure that any user‑controlled keys are validated against a secure hash or signature before use, and audit authentication logs for unexpected key manipulation attempts

Generated by OpenCVE AI on April 28, 2026 at 23:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-jqp3-qrgh-4846 NVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system
History
Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Nvidia nvflare
CPEs cpe:2.3:a:nvidia:nvflare:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Nvidia nvflare
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Nvidia
Nvidia flare Sdk
Vendors & Products Nvidia
Nvidia flare Sdk
Type Values Removed Values Added
Title Unauthenticated Authorization Bypass via User‑Controlled Key in NVIDIA FLARE Dashboard
Type Values Removed Values Added
Description NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service.
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key

Sources

Status
PUBLISHED
Assigner
nvidia
Published
Updated
Apr 29, 2026, 3:12 PM
Reserved
Jan 21, 2026, 7:09 PM

View source JSON

Updated
Apr 29, 2026, 1:42 PM

JSON

Status
Analyzed
Published
Apr 28, 2026, 7:36 PM
Modified
Oct 26, 2026, 8:10 PM

View source JSON

No data.

Updated
Apr 29, 2026, 10:10 AM

JSON