CVE-2026-65130: NVIDIA Infrastructure Controller RCE Flaw

CVE-2026-65130 Overview

NVIDIA Infrastructure Controller for Linux contains an operating system (OS) command injection vulnerability [CWE-78]. An attacker with high privileges on the network can inject arbitrary OS commands through the affected component. Successful exploitation can lead to code execution, data tampering, denial of service, and information disclosure. The vulnerability carries a scope change, meaning exploitation can impact resources beyond the vulnerable component's security boundary.

Critical Impact
Successful exploitation enables arbitrary OS command execution with the privileges of the Infrastructure Controller process, potentially leading to full host compromise, data tampering, service disruption, and disclosure of sensitive infrastructure data.

Affected Products

NVIDIA Infrastructure Controller for Linux
Specific affected versions: refer to the NVIDIA Product Security Advisory
Linux deployments running the vulnerable controller service

Discovery Timeline

2026-09-22 - CVE-2026-65130 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-65130

Vulnerability Analysis

The flaw is an OS command injection issue classified under [CWE-78]. The Infrastructure Controller accepts input that is passed to an operating system shell or command interpreter without sufficient sanitization or neutralization of shell metacharacters. An authenticated attacker with high privileges can craft input that breaks out of the intended command context and executes attacker-controlled commands on the host.

The scope change indicated by the CVSS vector means the injected commands can affect resources managed outside the controller's own security authority. In practice, this can allow lateral movement across the managed infrastructure, tampering with orchestration data, or forcing service outages. Confidentiality, integrity, and availability impacts are all rated high.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. The controller constructs shell command strings that incorporate values sourced from privileged callers without validating, escaping, or parameterizing those values before invoking the shell.

Attack Vector

The attack vector is network-based but requires high privileges and high attack complexity. An attacker who already holds elevated access on the controller's management interface submits crafted parameters containing shell metacharacters (for example, ;, |, `, or $()). When the controller assembles and executes the resulting command, the injected payload runs with the privileges of the controller service. Because no user interaction is required, exploitation can be scripted once the attacker holds the required credentials. Detailed technical information is available in the NVIDIA Product Security Advisory and the NVD entry for CVE-2026-65130.

Detection Methods for CVE-2026-65130

Indicators of Compromise

Unexpected child processes spawned by the NVIDIA Infrastructure Controller service, especially shells such as /bin/sh, /bin/bash, or interpreters like python, perl, or curl.
Controller log entries containing shell metacharacters (;, |, &&, `, $()) in fields that normally hold identifiers or paths.
Outbound network connections initiated by the controller process to unfamiliar hosts.
Modifications to system files, cron entries, or SSH authorized_keys performed under the controller service account.

Detection Strategies

Baseline the normal process tree of the Infrastructure Controller and alert on any deviation, particularly shell or scripting-language children.
Monitor authentication events on the controller's management interface for privileged sessions followed by anomalous command activity.
Correlate controller API request payloads with subsequent process execution events to surface injection attempts.

Monitoring Recommendations

Forward controller application logs, Linux auditd execve events, and process telemetry to a centralized analytics platform for correlation.
Enable command-line auditing on hosts running the controller and retain logs for post-incident analysis.
Track privileged account usage against the controller and alert on off-hours or anomalous administrative activity.

How to Mitigate CVE-2026-65130

Immediate Actions Required

Apply the fixed release referenced in the NVIDIA Product Security Advisory as soon as it is available in your change window.
Inventory all systems running NVIDIA Infrastructure Controller for Linux and confirm patch status.
Rotate credentials for any high-privilege accounts that can reach the controller's management interface.
Review controller and host logs for evidence of prior exploitation attempts.

Patch Information

NVIDIA has published guidance and fixed versions through the vendor advisory at NVIDIA product-security repository (2026/5879). Administrators should consult the advisory for the specific fixed version applicable to their deployment and follow the vendor upgrade procedure. Additional record data is available at the CVE.org record for CVE-2026-65130.

Workarounds

Restrict network access to the controller's management interface to a dedicated administration network or jump host.
Enforce multi-factor authentication and least-privilege on all accounts capable of invoking privileged controller operations.
Run the controller service under a dedicated, minimally privileged system account and constrain its filesystem and network access using Linux security modules such as SELinux or AppArmor.
Enable command execution auditing on controller hosts to detect exploitation attempts until patching is complete.

bash

# Configuration example: restrict management interface access with nftables
# Replace 10.0.10.0/24 with your administration subnet and <MGMT_PORT> with the controller port
nft add table inet nvidia_ic_filter
nft add chain inet nvidia_ic_filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet nvidia_ic_filter input ip saddr 10.0.10.0/24 tcp dport <MGMT_PORT> accept
nft add rule inet nvidia_ic_filter input tcp dport <MGMT_PORT> drop