NVIDIA DGX OS has a flaw in its factory provisioning process where cloning a base image copies the same SSH host keys across multiple systems. This duplication of cryptographic identifiers allows an attacker to impersonate a legitimate host or mount an attacker‑in‑‑middle attack, potentially achieving code execution, data tampering, privilege escalation, information disclosure, and denial of service. The vulnerability arises from reusing cryptographic keys, a weakness classified as CWE‑321.

The affected product is NVIDIA DGX Spark. No specific version information is provided, but the issue applies to all DGX Spark systems that use the default provisioning script to clone base images.

The CVSS score of 8.1 indicates high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the provisioning process itself; an attacker who can manipulate or observe the provisioning pipeline could inject malicious data or simply benefit from the shared keys. The potential for remote code execution and privilege escalation makes this a critical threat that requires immediate remediation.