CVE-2026-65128: NVIDIA Infrastructure Controller SQLI Flaw

CVE-2026-65128 Overview

CVE-2026-65128 is a SQL injection vulnerability [CWE-89] in NVIDIA Infrastructure Controller for Linux. An authenticated attacker with low privileges can inject malicious SQL statements through the network-accessible interface. Successful exploitation can lead to code execution, data tampering, denial of service, and information disclosure across the affected controller instance.

The vulnerability affects the confidentiality, integrity, and availability of the underlying database and any downstream systems that trust its data. NVIDIA published details in its product security advisory tracker on GitHub.

Critical Impact
Authenticated attackers can execute arbitrary SQL, potentially leading to remote code execution, backend data manipulation, and full compromise of the Infrastructure Controller database.

Affected Products

NVIDIA Infrastructure Controller for Linux (specific versions listed in the NVIDIA product security advisory)
Deployments exposing the controller management interface to authenticated network users
Linux hosts running the vulnerable controller software

Discovery Timeline

2026-09-22 - CVE-2026-65128 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-65128

Vulnerability Analysis

The flaw is a classic SQL injection weakness in the Infrastructure Controller's query-handling logic. User-supplied input reaches SQL statements without adequate parameterization or sanitization. An attacker with valid low-privileged credentials can send crafted requests over the network that alter the intended query structure.

Because the network attack vector requires no user interaction and low attack complexity, the exploitation barrier is limited to obtaining any authenticated session on the controller. Downstream consequences include arbitrary code execution through database-hosted procedures, tampering with configuration records, and disclosure of sensitive infrastructure metadata.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands [CWE-89]. The vulnerable component concatenates or interpolates untrusted input directly into SQL queries rather than using prepared statements with bound parameters. This allows an attacker to break out of the intended query context.

Attack Vector

Exploitation occurs over the network against the controller's management or API interface. The attacker authenticates with any valid low-privilege account, then submits payloads that include SQL metacharacters within request parameters processed by the vulnerable query path.

No verified public proof-of-concept code has been released. Refer to the NVIDIA product security advisory for technical details on the affected component and payload surface.

Detection Methods for CVE-2026-65128

Indicators of Compromise

Unusual SQL syntax such as UNION SELECT, --, ;, or stacked queries appearing in Infrastructure Controller HTTP request logs
Unexpected database errors, long-running queries, or new stored procedures created outside change control
Authentication events from low-privileged accounts followed by administrative actions or configuration changes
Egress connections from the controller host to unfamiliar external destinations

Detection Strategies

Enable database query logging on the controller backend and alert on queries containing common injection patterns or errors
Deploy a web application firewall with SQL injection signatures in front of the controller management interface
Correlate authentication logs with API request bodies to identify low-privileged accounts issuing anomalous parameter values

Monitoring Recommendations

Baseline normal API parameter values and flag requests that deviate significantly in length or character composition
Monitor the controller host for unexpected process creation, especially child processes spawned by the database service
Forward controller, host, and database telemetry to a centralized analytics platform for cross-source correlation

How to Mitigate CVE-2026-65128

Immediate Actions Required

Apply the fixed version referenced in the NVIDIA product security advisory as soon as it is available for your deployment
Restrict network access to the Infrastructure Controller management interface to trusted administrative networks only
Rotate credentials for all controller accounts and revoke unused low-privileged accounts
Audit database contents and configuration records for unauthorized modifications since the controller was first exposed

Patch Information

NVIDIA has published advisory details at the NVIDIA product-security GitHub repository. Consult the advisory for exact fixed versions and upgrade guidance. Additional metadata is available on the NVD entry for CVE-2026-65128 and the CVE.org record.

Workarounds

Place the controller behind a reverse proxy or WAF that inspects and blocks SQL injection payloads
Enforce network segmentation so only jump hosts and approved administrator workstations can reach the controller
Apply least-privilege database roles so the controller's database account cannot execute administrative or file-system operations

bash

# Example: restrict controller management port to a trusted admin subnet using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP