CVE-2026-65128

SQL injection in NVIDIA Infrastructure Controller for Linux

View on CVE.org
Published Sep 22, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

Analysis

AI-generated

Technical impact

NVIDIA Infrastructure Controller for Linux contains a SQL injection vulnerability that allows attackers to inject arbitrary SQL statements. The vulnerability can lead to remote code execution, data tampering, denial of service, and information disclosure. This weakness is classified as SQL Injection (CWE-89).

Affected Systems

The affected vendor is NVIDIA, product is the Infrastructure Controller running on Linux. No specific affected version is listed in the available data.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector could be remote if the controller has a network‑facing interface. Exploitation would require the ability to supply crafted input to the controller's database interface, and successful execution could provide an attacker with high privileges or system compromise.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest NVIDIA Infrastructure Controller firmware update that contains the SQL injection fix.
  • Disable any unused management interfaces and restrict network access to the controller to trusted hosts only.
  • Ensure that all database interactions in the controller use parameterized queries or properly sanitize user inputs to mitigate SQL injection attacks.

Generated by OpenCVE AI on September 22, 2026 at 15:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Nvidia infra Controller
CPEs cpe:2.3:a:nvidia:infra_controller:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Nvidia infra Controller
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Nvidia
Nvidia infrastructure Controller
Vendors & Products Nvidia
Nvidia infrastructure Controller
Type Values Removed Values Added
Title SQL injection in NVIDIA Infrastructure Controller for Linux
Type Values Removed Values Added
Description NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
nvidia
Published
Updated
Sep 22, 2026, 3:16 PM
Reserved
Jul 21, 2026, 5:12 PM

View source JSON

Updated
Sep 22, 2026, 3:16 PM

JSON

Status
Analyzed
Published
Sep 22, 2026, 3:17 PM
Modified
Sep 29, 2026, 6:13 PM

View source JSON

No data.

Updated
Sep 22, 2026, 7:14 PM

JSON