NVIDIA AIStore for Linux contains a Server‑Side Request Forgery (SSRF) flaw in its distributed sort component. An attacker can supply a crafted external key map URL that the framework will fetch, allowing the malicious actor to force the server to issue outbound requests. If the attacker successfully coaxes the server into retrieving sensitive data or interacting with internal systems, the exploit may result in information disclosure. The weakness is identified as CWE‑918, a classic SSRF vulnerability.

The vulnerability affects the NVIDIA AIStore framework on Linux. No specific version numbers are provided in the advisory, so all deployments of AIStore using the distributed sort feature are potentially impacted until a patch is applied.

The CVSS v3.1 rating of 8.6 classifies this flaw as high severity. Because the EPSS score is unavailable and the vulnerability has not been listed in CISA’s KEV catalog, the precise likelihood of exploitation is unknown, but the attack vector is inferred to be remote, requiring the ability to influence the key map URL input from an external source. The impact would be limited to information disclosure and does not immediately facilitate privilege escalation or full remote code execution based on the provided description.