NVIDIA AIStore for Linux has a missing authentication flaw in its token‑revocation endpoint. An unauthenticated remote attacker can send crafted lists of tokens to revoke. This misuse may allow the attacker to tamper with data stored in the system and to cause a denial‑of‑service condition by exhausting resources or invalidating legitimate tokens. The weakness corresponds to inadequate authentication practices (CWE‑306).

The vulnerability affects NVIDIA AIStore framework on Linux. No specific version ranges are listed in the CNA data, so all installed instances of AIStore should be considered potentially exposed until a vendor patch is applied.

The CVSS score is 9.1, indicating high severity. The EPSS score is not provided, so the current exploit probability is unknown, but the lack of KEV listing suggests no known active exploitation yet. The attack vector is inferred to be remote over the network because the token‑revocation endpoint is a network‑accessible service and the user can send crafted requests without first authenticating.