{"cve":"CVE-2026-65172","nvd":{"published":"2026-10-13T13:17:33.410","modified":"2026-10-13T16:18:53.587","status":"Awaiting Analysis","description":"NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy.\n\nA successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","score":8.6},"cwes":["CWE-862"],"references":["https://github.com/NVIDIA/product-security/tree/main/2026/5889","https://nvd.nist.gov/vuln/detail/CVE-2026-65172","https://www.cve.org/CVERecord?id=CVE-2026-65172"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:58:52.678897993+00:00"},"epss":{"cve":"CVE-2026-65172","score":0.00383,"percentile":0.32056,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}