CVE-2026-65173

Summary

NVIDIA AIStore for Linux has a missing authentication vulnerability in its token-revocation endpoint that allows unauthenticated attackers to submit crafted token lists, potentially leading to data tampering and denial of service.

Exploitability

Exploitation is straightforward as it requires only sending crafted requests to the unprotected token-revocation endpoint with no authentication required, making it highly accessible to remote attackers.

Blast radius

If exploited, this vulnerability could allow attackers to revoke legitimate tokens, disrupt access to AIStore services, and potentially tamper with data in the system across a wide range of affected deployments.

Detection

Monitor for unauthorized requests to the token-revocation endpoint (typically /api/token/revoke) in web server logs, looking for patterns of repeated or unusual token-revocation calls without proper authentication headers.

Prioritized remediation

Upgrade to NVIDIA AIStore version 2.590 or later to address this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.