CVE-2026-65129: NVIDIA Infrastructure Controller Info Leak

CVE-2026-65129 Overview

CVE-2026-65129 is an improper certificate validation vulnerability [CWE-295] in NVIDIA Infrastructure Controller for Linux. An attacker positioned on an adjacent network can abuse the flawed validation logic to intercept or manipulate traffic that the controller trusts. Successful exploitation may lead to information disclosure, data tampering, and denial of service.

The issue requires low privileges and no user interaction, but the attacker must have adjacent network access and overcome high attack complexity. Because the controller manages infrastructure operations, compromise of its trust boundary can expose sensitive management data and disrupt orchestrated workloads.

Critical Impact
Attackers with adjacent network access can bypass TLS trust checks, enabling man-in-the-middle interception, tampering of controller traffic, and disruption of managed infrastructure services.

Affected Products

NVIDIA Infrastructure Controller for Linux

Discovery Timeline

2026-09-22 - CVE-2026-65129 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-65129

Vulnerability Analysis

CVE-2026-65129 stems from improper certificate validation [CWE-295] within NVIDIA Infrastructure Controller for Linux. The controller establishes trust in remote endpoints without correctly verifying certificate properties such as chain of trust, hostname, or expiration. An attacker who can present or substitute a certificate on an adjacent network segment can convince the controller that a malicious endpoint is legitimate.

Once the trust decision is subverted, the attacker can decrypt, read, or modify traffic that was intended to be protected by TLS. This breaks the confidentiality and integrity guarantees that the controller relies on for management and orchestration flows. The vulnerability also allows targeted disruption of communications, producing denial-of-service conditions in managed infrastructure.

Exploitation requires low privileges on a system that can reach the controller over an adjacent network. The high attack complexity reflects the need to position on the correct network segment and to time or shape the certificate presentation appropriately.

Root Cause

The root cause is missing or incomplete validation of X.509 certificates presented to the controller. Typical failure modes in this class include skipping chain verification, accepting self-signed certificates, ignoring hostname mismatches, or failing to enforce certificate revocation checks. Any of these gaps allow an attacker-controlled certificate to be accepted as trusted.

Attack Vector

The attack vector is Adjacent Network (AV:A). An attacker must reach the controller from the same broadcast domain, VLAN, or logically adjacent segment. From that position, the attacker performs a man-in-the-middle attack against a session the controller initiates or receives, presenting a certificate that the flawed validation logic accepts.

No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities listing is associated with CVE-2026-65129 at publication. No verified code examples are available. See the NVIDIA product security advisory for vendor-supplied technical detail.

Detection Methods for CVE-2026-65129

Indicators of Compromise

Unexpected TLS certificates presented to Infrastructure Controller hosts, particularly certificates signed by unknown or untrusted authorities.
Anomalous ARP, DHCP, or routing changes on network segments adjacent to controller nodes, indicating possible man-in-the-middle positioning.
Unexplained gaps, retransmissions, or session resets in controller-to-managed-node traffic that correlate with configuration or state anomalies.

Detection Strategies

Enable verbose TLS handshake logging on the controller and alert on certificate chains, issuers, or subject names that deviate from a known baseline.
Deploy network monitoring that fingerprints TLS certificates on the management network and flags newly observed leaf or intermediate certificates.
Correlate authentication and orchestration events with network-layer anomalies to identify sessions that succeeded despite abnormal certificate presentation.

Monitoring Recommendations

Continuously monitor the management VLANs hosting NVIDIA Infrastructure Controller for Linux for rogue devices and Layer 2 attacks.
Track integrity of controller configuration and orchestration state, alerting on unexpected changes that could indicate tampering.
Retain and review controller and network telemetry to support forensic reconstruction of any suspected interception event.

How to Mitigate CVE-2026-65129

Immediate Actions Required

Inventory all NVIDIA Infrastructure Controller for Linux deployments and identify versions exposed to adjacent-network attackers.
Restrict management-plane connectivity to dedicated, tightly segmented networks with strict Layer 2 controls.
Apply vendor updates from NVIDIA as soon as they are available for your affected version.

Patch Information

Refer to the NVIDIA product security advisory for CVE-2026-65129 for the definitive list of fixed versions and update guidance. Additional metadata is available in the NIST NVD entry and the CVE.org record.

Workarounds

Isolate the controller management network using VLANs, private VRFs, or out-of-band management to reduce adjacent-network exposure.
Enforce mutual TLS with pinned certificates or a private certificate authority for all controller communications where supported.
Enable Layer 2 protections such as dynamic ARP inspection, DHCP snooping, and port security to hinder man-in-the-middle positioning.
Monitor for and block unauthorized devices on segments that can reach the controller until patched builds are deployed.

bash

# Configuration example
# Vendor-neutral hardening: restrict controller management traffic to a dedicated segment
# and enforce Layer 2 controls on the switch fabric.

# Example (Cisco IOS) enabling dynamic ARP inspection and DHCP snooping on the
# management VLAN used by NVIDIA Infrastructure Controller for Linux.
configure terminal
 ip dhcp snooping
 ip dhcp snooping vlan 20
 ip arp inspection vlan 20
 interface range GigabitEthernet1/0/1 - 24
  switchport mode access
  switchport access vlan 20
  ip arp inspection limit rate 15
  spanning-tree bpduguard enable
end
write memory