CVE-2026-9142: NI InstrumentStudio Auth Bypass Vulnerability

CVE-2026-9142 Overview

CVE-2026-9142 is an insecure default credentials vulnerability in National Instruments (NI) grpc-device server. The flaw exists when Transport Layer Security (TLS) configuration is absent and the server binds to interfaces beyond loopback. Under these conditions, an unauthenticated attacker on the local network can access the gRPC service controlling test and measurement instrumentation. The vulnerability affects NI grpc-device version 2.17.0 and prior, and is also exposed through NI InstrumentStudio releases 2026 Q1 and 2026 Q2. The weakness is tracked as [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Unauthenticated network attackers can reach the gRPC device server and interact with connected instruments without any credential challenge.

Affected Products

NI grpc-device server, versions 2.17.0 and earlier
NI InstrumentStudio 2026 Q1
NI InstrumentStudio 2026 Q2

Discovery Timeline

2026-06-19 - CVE-2026-9142 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9142

Vulnerability Analysis

The NI grpc-device server exposes a gRPC interface for remote control of National Instruments hardware, including data acquisition and test instrumentation. When operators deploy the server without configuring TLS and bind the listener to a non-loopback interface, the service accepts connections without verifying client identity. Any host on the reachable network segment can invoke device control RPCs, read instrument state, and submit measurement commands. The impact extends to confidentiality and integrity of measurement workflows and the hardware operating under those workflows.

Root Cause

The defect is a configuration design flaw classified under [CWE-306]. The server ships with default settings that do not require authentication when TLS is not enabled. Binding the gRPC listener beyond localhost therefore exposes a privileged control surface to the network without any credential check. The product does not fail closed when TLS material is missing.

Attack Vector

Exploitation requires only network reachability to the gRPC port on a host running a vulnerable grpc-device server. The attacker sends standard gRPC requests against the documented service definitions. No user interaction, prior authentication, or elevated privileges are required. Specific exploitation code is not described in the vendor advisory. Refer to the GitHub Security Advisory GHSA-fhhw-37q8-6562 for vendor-supplied technical detail.

Detection Methods for CVE-2026-9142

Indicators of Compromise

Unexpected gRPC connections to hosts running NI grpc-device from systems outside the test bench network
Instrument state changes, calibration writes, or measurement sessions initiated outside scheduled lab activity
grpc-device server processes bound to 0.0.0.0 or external interfaces rather than 127.0.0.1

Detection Strategies

Inventory hosts running NI InstrumentStudio or the grpc-device server and audit listener bind addresses with netstat or ss
Inspect server configuration files for missing server_security_options and absent TLS certificate paths
Capture network flow data on lab segments to identify gRPC traffic originating from unauthorized clients

Monitoring Recommendations

Alert on new TCP listeners on ports used by grpc-device that are reachable from corporate or guest VLANs
Forward host and network telemetry to a centralized analytics platform for correlation against authorized engineering workstations
Track process start events for the grpc-device server and flag instances launched with non-loopback bind arguments

How to Mitigate CVE-2026-9142

Immediate Actions Required

Upgrade NI grpc-device to a release later than 2.17.0 as identified in the vendor advisory
Restrict the server bind address to 127.0.0.1 where remote access is not required
Enforce TLS by provisioning server certificates and configuring client certificate validation before exposing the service to any network
Place lab automation networks behind firewall rules that restrict gRPC ports to authorized engineering workstations

Patch Information

National Instruments has published fixed builds and guidance through the NI Critical Security Update bulletin and the GitHub Security Advisory GHSA-fhhw-37q8-6562. Apply the vendor-supplied update to all systems running grpc-device 2.17.0 or earlier and to InstrumentStudio 2026 Q1 and 2026 Q2 installations.

Workarounds

Bind the grpc-device server exclusively to the loopback interface when remote clients are not required
Segment instrumentation hosts onto an isolated VLAN with strict ingress controls
Require a mutually authenticated TLS tunnel or VPN in front of any non-loopback deployment until patches are applied

bash

# Configuration example - restrict server to loopback and require TLS
# server_config.json
{
  "port": 31763,
  "address": "127.0.0.1",
  "server_cert": "/etc/ni/grpc-device/server.crt",
  "server_key": "/etc/ni/grpc-device/server.key",
  "root_cert": "/etc/ni/grpc-device/ca.crt"
}