CVE-2026-65117: NVIDIA Infrastructure Controller Info Leak

CVE-2026-65117 is an information disclosure vulnerability in NVIDIA Infrastructure Controller for Linux caused by hard-coded password use. Attackers can exploit this to tamper with data and cause denial of service. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-65117 Overview

NVIDIA Infrastructure Controller for Linux contains a hard-coded password vulnerability tracked as CVE-2026-65117. An attacker with adjacent network access can leverage the embedded credential to authenticate to the controller without knowledge of a legitimate secret. Successful exploitation can lead to data tampering, denial of service, and information disclosure. The weakness is classified under CWE-259: Use of Hard-coded Password. NVIDIA published details in its product security advisory repository.

Critical Impact
Adjacent-network attackers can authenticate using an embedded credential, enabling tampering with controller data, service disruption, and disclosure of sensitive infrastructure information.

Affected Products

NVIDIA Infrastructure Controller for Linux

Discovery Timeline

2026-09-22 - CVE-2026-65117 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-65117

Vulnerability Analysis

The NVIDIA Infrastructure Controller for Linux ships with a hard-coded password embedded in the product. Any actor who obtains the credential, either through reverse engineering of the distributed binaries or reuse across deployments, can authenticate to the controller. The credential is static and identical across affected installations, so rotation by an operator does not remove the exposure. Once authenticated, the attacker interacts with controller functions as a legitimate user, bypassing normal access boundaries.

Successful exploitation can result in three outcomes documented by the vendor: data tampering against controller-managed state, denial of service by disrupting controller operations, and information disclosure of infrastructure telemetry or configuration. The vulnerability requires adjacent network positioning, so the attacker must reach the controller through a directly connected network segment such as the management VLAN.

Root Cause

The root cause is the inclusion of a static password within the product distribution [CWE-259]. Hard-coded credentials violate secure-by-design principles because they cannot be revoked without a code change and are typically recoverable through static analysis of the shipped software.

Attack Vector

The attack vector is adjacent network. An attacker on the same broadcast domain or management network as the controller submits authentication requests using the embedded credential. No user interaction is required, and no prior privileges on the target are needed. Attack complexity is elevated because the attacker must first recover the credential and reach the adjacent network segment where the controller is exposed.

No verified proof-of-concept code has been published. See the NVIDIA advisory for authoritative technical details.

Detection Methods for CVE-2026-65117

Indicators of Compromise

Successful authentication events to the Infrastructure Controller from hosts that are not part of the authorized administrator inventory.
Configuration or state changes on the controller that do not correlate with an approved change ticket.
Unexpected outbound connections from the controller following an unfamiliar authentication event.

Detection Strategies

Compare controller authentication logs against an allowlist of administrative source addresses and alert on deviations.
Baseline the controller's normal API and management-plane traffic, then flag deviations in volume, endpoints, or session timing.
Monitor for repeated failed authentication attempts followed by a success from the same adjacent-network source, which suggests credential probing.

Monitoring Recommendations

Forward controller authentication, audit, and configuration-change logs to a centralized SIEM for correlation.
Enable packet capture or NetFlow on the management segment hosting the controller to preserve evidence of adjacent-network access attempts.
Track integrity hashes of controller configuration files and alert on unscheduled modifications.

How to Mitigate CVE-2026-65117

Immediate Actions Required

Apply the NVIDIA update referenced in the product security advisory as soon as it is available for your deployment.
Restrict management-plane access to the controller so that only authorized administrator hosts can reach it over the adjacent network.
Audit recent controller authentication and configuration-change events for signs of unauthorized use.

Patch Information

Refer to the NVIDIA product security repository entry for 2026/5879 for the vendor-supplied fixed versions and update instructions. Additional metadata is available in the NVD record for CVE-2026-65117 and the CVE.org record.

Workarounds

Isolate the Infrastructure Controller on a dedicated management VLAN with strict access control lists limiting traffic to known administrator subnets.
Enforce network-layer authentication such as 802.1X on the management segment to reduce the pool of hosts that can reach the controller.
Increase logging verbosity on the controller and forward events off-box to preserve an audit trail while a patch is being scheduled.

bash

# Configuration example: restrict management access to the controller with iptables
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP