CVE-2026-65162

Summary

NVIDIA AIStore for Linux contains a vulnerability in its legacy ETL Kubernetes PodSpec initialization API that allows remote attackers to inject host-namespace and container-security settings, potentially leading to code execution and privilege escalation.

Exploitability

Exploitation is likely straightforward for remote attackers with no authentication required, as the vulnerability exists in an exposed API endpoint that accepts unvalidated Kubernetes configuration parameters.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on Kubernetes nodes, escalate privileges, and potentially compromise entire containerized workloads across affected clusters.

Detection

Monitor for unusual Kubernetes PodSpec configurations in API requests, particularly those containing hostPath mounts or privileged container settings, and watch for network connections to the affected API endpoint from external IPs.

Prioritized remediation

Disable the legacy ETL Kubernetes PodSpec initialization API immediately or upgrade to NVIDIA AIStore version 2.590 or later if available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.