CVE-2026-65170 in AIStore
Summary
by MITRE • 10/13/2026
NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a crafted original URL. A successful exploit of this vulnerability may lead to information disclosure.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The NVIDIA AIStore platform, designed to accelerate data-intensive artificial intelligence workloads through high-performance storage abstractions, contains a critical security flaw within its experimental HyperTransport backend implementation for Linux systems. This specific component is intended to facilitate low-latency communication between nodes in distributed computing clusters by leveraging direct hardware interconnects rather than traditional network stacks. However, the vulnerability arises from insufficient validation of input parameters related to URL handling during request processing operations. An unauthenticated remote attacker can exploit this weakness by submitting a specially crafted original URL that triggers server-side logic errors within the backend handler. The core technical flaw lies in the application's failure to properly sanitize or restrict the destination addresses and protocols allowed when forwarding requests, thereby creating an opportunity for Server-Side Request Forgery attacks.
Server-Side Request Forgery represents a significant class of vulnerabilities where an attacker induces the server to make HTTP requests to arbitrary domains or internal services that would otherwise be inaccessible from the external network. In this context, because AIStore often operates within tightly coupled high-performance computing environments, the backend may have access to sensitive internal metadata stores, configuration endpoints, or other microservices running on localhost or private subnets. By manipulating the original URL parameter, an attacker can force the NVIDIA AIStore server to initiate connections to these restricted resources. This bypasses standard network perimeter defenses since the requests originate from a trusted internal service rather than an external IP address, effectively allowing the attacker to probe and interact with backend infrastructure components that are not directly exposed to the public internet.
The operational impact of this vulnerability is primarily centered on information disclosure and potential lateral movement within the cluster environment. A successful exploitation allows an unauthenticated actor to retrieve sensitive data stored in internal services accessed via forged requests. This could include configuration files, authentication tokens, database credentials, or proprietary model weights depending on what resources are reachable through the AIStore backend's network context. Furthermore, if the targeted internal service is vulnerable to other injection techniques such as command execution or XML external entity processing, the initial SSRF vector could serve as a foothold for more severe compromises. The lack of authentication requirements exacerbates the risk, enabling any remote host with network connectivity to attempt exploitation without needing valid credentials, significantly lowering the barrier for attack initiation and increasing the likelihood of successful compromise in environments where perimeter security is relied upon heavily.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective short-term solution involves disabling or removing the experimental HT backend if it is not strictly required for production workloads, as experimental features often lack rigorous security auditing compared to stable releases. For organizations that require this functionality, implementing strict allowlists for permitted destination URLs and IP addresses within the configuration parameters can prevent access to internal resources. Additionally, deploying a reverse proxy or web application firewall with SSRF detection capabilities can help filter malicious requests before they reach the AIStore service. NVIDIA has acknowledged the issue in their security advisories, so applying the latest available patches that include input validation fixes is critical. Long-term defenses should involve enforcing network segmentation to limit the blast radius of any potential breach and ensuring that all internal services require authentication even when accessed from localhost or trusted subnets, thereby neutralizing the impact of SSRF vulnerabilities regardless of their origin.