Description
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
Published: 2026-09-22
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

NVIDIA Infrastructure Controller for Linux contains a SQL injection vulnerability that allows attackers to inject arbitrary SQL statements. The vulnerability can lead to remote code execution, data tampering, denial of service, and information disclosure. This weakness is classified as SQL Injection (CWE-89).

Affected Systems

The affected vendor is NVIDIA, product is the Infrastructure Controller running on Linux. No specific affected version is listed in the available data.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector could be remote if the controller has a network‑facing interface. Exploitation would require the ability to supply crafted input to the controller's database interface, and successful execution could provide an attacker with high privileges or system compromise.

Generated by OpenCVE AI on September 22, 2026 at 15:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest NVIDIA Infrastructure Controller firmware update that contains the SQL injection fix.
  • Disable any unused management interfaces and restrict network access to the controller to trusted hosts only.
  • Ensure that all database interactions in the controller use parameterized queries or properly sanitize user inputs to mitigate SQL injection attacks.

Generated by OpenCVE AI on September 22, 2026 at 15:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Nvidia infra Controller
CPEs cpe:2.3:a:nvidia:infra_controller:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Nvidia infra Controller

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Nvidia
Nvidia infrastructure Controller
Vendors & Products Nvidia
Nvidia infrastructure Controller

Tue, 22 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
Title SQL injection in NVIDIA Infrastructure Controller for Linux

Tue, 22 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Linux Linux Kernel
Nvidia Infra Controller Infrastructure Controller
cve-icon MITRE

Status: PUBLISHED

Assigner: nvidia

Published:

Updated: 2026-09-22T15:16:52.309Z

Reserved: 2026-07-21T17:12:33.431Z

Link: CVE-2026-65128

cve-icon Vulnrichment

Updated: 2026-09-22T15:16:44.388Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-22T15:17:13.183

Modified: 2026-09-29T18:13:49.893

Link: CVE-2026-65128

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T19:14:40Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')