Description
NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a crafted original URL. A successful exploit of this vulnerability may lead to information disclosure.
Published: 2026-10-13
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in NVIDIA AIStore’s experimental HT backend and allows a remote actor to craft an original URL that triggers server‑side request forgery. If successful, sensitive internal resources can be accessed, resulting in information disclosure. The weakness is classified as CWE-918.

Affected Systems

The affected product is NVIDIA AIStore for Linux, specifically the experimental HT backend. No specific version or patchlevel is listed in the available data, so all installations of this component may be impacted until a fix is released.

Risk and Exploitability

The CVSS score of 8.6 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog, yet the attack path requires only an unauthenticated HTTP request to the AIStore service. Because the attacker can supply a crafted URL to a remote server, the risk of exploitation remains significant, especially in environments where the service is exposed to untrusted networks.

Generated by OpenCVE AI on October 13, 2026 at 16:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade NVIDIA AIStore to the latest version that contains the SSRF fix
  • Disable or remove the experimental HT backend if it is not required by your deployment
  • Restrict network access to the AIStore endpoint using firewalls or VPNs to prevent connections from untrusted sources

Generated by OpenCVE AI on October 13, 2026 at 16:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Nvidia
Nvidia aistore Framework
Vendors & Products Nvidia
Nvidia aistore Framework

Tue, 13 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote SSRF Vulnerability in NVIDIA AIStore HT Backend

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Description NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a crafted original URL. A successful exploit of this vulnerability may lead to information disclosure.
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Nvidia Aistore Framework
cve-icon MITRE

Status: PUBLISHED

Assigner: nvidia

Published:

Updated: 2026-10-13T14:39:07.379Z

Reserved: 2026-07-21T17:35:38.655Z

Link: CVE-2026-65170

cve-icon Vulnrichment

Updated: 2026-10-13T14:29:10.587Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T13:17:33.283

Modified: 2026-10-13T16:18:53.587

Link: CVE-2026-65170

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T21:20:26Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)