NVIDIA AIStore for Linux and Kubernetes exposes a missing authorization flaw in its ETL management API. An unauthenticated attacker can send specially crafted GET or POST requests to the AIStore proxy and retrieve details about existing ETL jobs or execute start or stop commands. This enables disclosure of internal job metadata and the ability to disrupt or tamper with the integrity and availability of the data‑processing pipelines.

The vulnerability is specific to NVIDIA’s AIStore framework deployed on Linux and Kubernetes clusters. No particular version range is listed, so any installation of the AIStore product is potentially affected until a patch is applied.

The CVSS score of 8.6 indicates high severity, and although the EPSS score is not available, the issue is not yet in the CISA KEV catalog. The attack vector is inferred to be remote unauthenticated over a network path, as the flaw enables access without credentials. Given the high CVSS and the nature of the impact, the risk is significant and requires timely remediation.