Executive Summary
NVIDIA has disclosed a critical vulnerability, CVE-2026-65113, in Infrastructure Controller for Linux, the vendor's management software for bare-metal and container hardware in data center environments. The flaw stems from the use of hard-coded credentials (CWE-798) and carries a maximum-severity CVSS 3.1 base score of 9.8. Because the vector requires no privileges and no user interaction and is exploitable over the network, a successful exploit could let an attacker escalate privileges, tamper with data, disrupt service availability, and disclose sensitive information — potentially amounting to full compromise of an affected host.
The advisory was published as part of a broader NVIDIA Infrastructure Controller security bulletin on September 22, 2026, which addressed 14 vulnerabilities in total. CVE-2026-65113 is the most severe of that batch. As of this writing, the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept exploit code has been confirmed. Organizations running Infrastructure Controller should nonetheless treat this as an urgent patching priority given the low bar for exploitation.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE ID | CVE-2026-65113 |
| CVSS Score | 9.8 (Critical) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-798: Use of Hard-coded Credentials |
| Vendor | NVIDIA |
| Product | Infrastructure Controller for Linux |
| Affected Component | Credential handling / authentication subsystem |
| Affected Versions | 0 through 1.9 |
| Fixed Version | 2.0 or later |
| Exploitation Status | No confirmed in-the-wild exploitation; not in CISA KEV; no verified public PoC |
Technical Analysis
CWE-798, "Use of Hard-coded Credentials," describes software that embeds a fixed username, password, cryptographic key, or token directly in source code, configuration files, or a compiled binary rather than requiring each deployment to set its own unique secret. Because the credential is identical across every installation of the affected software, anyone who obtains a copy of the software — through reverse engineering, public source access, or simply reading the same version NVIDIA shipped to everyone else — effectively holds a valid credential for every other unpatched deployment.
In the context of Infrastructure Controller for Linux, the NVD description states that the vulnerability "could cause use of hard-coded credentials," and that a successful exploit "might lead to escalation of privileges, data tampering, denial of service, and information disclosure." Because Infrastructure Controller is a management-plane component with broad control over the bare-metal and container hardware it oversees, a credential that grants unauthorized access to it does not just expose one service — it can expose the ability to reconfigure, disrupt, or extract data from every system the controller manages. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network, requires low attack complexity, needs no prior privileges, and needs no user interaction, which is why the base score reaches the maximum practical severity of 9.8.
Why This Matters
Infrastructure Controller sits at a privileged layer of the data center stack, coordinating hardware lifecycle and orchestration tasks that individual workloads should never be able to touch directly. A hard-coded credential in that layer collapses the intended trust boundary: instead of needing to compromise an operator's account or pivot through multiple systems, an attacker who knows (or discovers) the embedded credential can potentially authenticate directly as a trusted internal component. Combined with the "no authentication required to begin the attack, no user interaction" profile of the CVSS vector, this turns what would normally be a multi-step intrusion into a single exploitation step for any attacker with network reachability to the controller.
Impact Assessment
| Area | Risk |
|---|---|
| Confidentiality | High — hard-coded credentials can expose sensitive infrastructure and configuration data |
| Integrity | High — authenticated-equivalent access allows unauthorized data tampering |
| Availability | High — the same access path can be used to disrupt or deny service |
| Privilege Escalation | High — embedded credentials can grant elevated access without legitimate authorization |
| Lateral Movement | Elevated — compromise of a management-plane component can expose every host/container it controls |
| Exploitation Complexity | Low — network-reachable, no privileges or user interaction required |
Remediation
- Apply the vendor fix. Update NVIDIA Infrastructure Controller for Linux to version 2.0 or later, which NVIDIA identifies as the release that addresses this issue along with the other 13 vulnerabilities disclosed in the same bulletin.
- Inventory exposure. Identify every instance of Infrastructure Controller for Linux in your environment (versions 0 through 1.9 are affected) before assuming you are unaffected.
- Restrict network access. Until patched, limit network reachability to the controller's management interfaces to trusted administrative networks only — do not expose it directly to untrusted or general-purpose networks.
- Rotate credentials post-patch. Because the root cause is a hard-coded credential, treat any credential associated with the affected component as potentially known to third parties; rotate related secrets after upgrading.
- Review the full bulletin. The same September 2026 advisory covers 13 additional vulnerabilities (including SQL injection, missing authentication, and improper certificate validation issues), several rated high severity — patch holistically rather than for CVE-2026-65113 alone.
- Monitor for anomalous access. Watch authentication and administrative-action logs on Infrastructure Controller deployments for unexpected activity while patching is in progress.
- Track exploitation status. No public PoC or KEV listing exists as of this advisory's publication — re-verify this status before deprioritizing remediation, as this can change quickly for critical, unauthenticated, network-exploitable flaws.