Description
NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.
Published: 2026-10-13
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Information disclosure
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in the Promote API of NVIDIA AIStore for Linux. An unauthenticated remote attacker can supply a crafted absolute source path and cause the target process to read files that the process can access. Because no authentication is required to trigger this behavior, an attacker could obtain sensitive system information or configuration files, leading to information disclosure. The flaw is a classic path traversal issue (CWE‑22) that bypasses normal file permissions.

Affected Systems

The affected product is NVIDIA AIStore running on Linux. No specific version range is listed, so any installation of NVIDIA AIStore for Linux is potentially vulnerable until a patch or update is applied.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, unauthenticated, and requires only the ability to invoke the Promote API. An attacker could trigger the vulnerability by sending a crafted request over the network and read arbitrary files that the AIStore process can access. No special privilege or local access is required, making the risk realistic for exposed deployments.

Generated by OpenCVE AI on October 13, 2026 at 16:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update NVIDIA AIStore to the latest release that contains the fix.
  • Restrict network access to the Promote API endpoint, for example by firewalling or placing the service behind an access control layer that only allows trusted clients.
  • Consider hardening file permissions and disabling the ability for the AIStore process to access sensitive directories that are not needed for normal operation.
  • Monitor API logs for unexpected requests containing absolute paths and investigate anomalous activity.

Generated by OpenCVE AI on October 13, 2026 at 16:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Nvidia
Nvidia aistore Framework
Vendors & Products Nvidia
Nvidia aistore Framework

Tue, 13 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote File Read via Promote API in NVIDIA AIStore

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Description NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Nvidia Aistore Framework
cve-icon MITRE

Status: PUBLISHED

Assigner: nvidia

Published:

Updated: 2026-10-13T14:39:07.630Z

Reserved: 2026-07-21T17:35:38.654Z

Link: CVE-2026-65161

cve-icon Vulnrichment

Updated: 2026-10-13T14:29:13.265Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T13:17:32.710

Modified: 2026-10-13T16:18:53.587

Link: CVE-2026-65161

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T21:20:31Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')