NVIDIA License System - Delegated Licensing Service (DLS): An unauthorised action against the DLS reaches partial

Impact

An unauthorised action against the DLS reaches partial denial of service and disclosure of confidential information. A DLS outage eventually strands vGPU guests when cached licences expire, so this is an availability problem for the whole vGPU estate, not just a management-plane nuisance.

Who can reach it

Adjacent network, no privileges required. Anyone with a route to the licensing appliance - which is usually the same management VLAN as everything else.

What to do

Update the DLS appliance per bulletin 5570. Cost: appliance restart only. Confirm your licence lease duration so you know how long guests survive a DLS outage before this becomes a tenant-visible incident.

References

Related entries

• NVIDIA License System - Delegated Licensing Service (DLS): SQL injection in the DLS appliance reaching a high integrityCVE-2025-23292 · NVIDIA License System - Delegated Licensing Service (DLS)Medium
• NVIDIA License System - Delegated Licensing Service (DLS): Improper authentication in the DLS lets an unauthenticatedCVE-2026-24241 · NVIDIA License System - Delegated Licensing Service (DLS)Medium
• NVIDIA License System - Delegated Licensing Service (DLS): An authorised-looking action leads to information disclosureCVE-2025-23291 · NVIDIA License System - Delegated Licensing Service (DLS)Low
• NVIDIA License System - Delegated Licensing Service (DLS): An unauthorised action against the DLS reaches highCVE-2025-23293 · NVIDIA License System - Delegated Licensing Service (DLS)High
• Container Toolkit / GPU Operator: Container escape to host root (insufficient input validation)CVE-2024-0135 · Container Toolkit / GPU OperatorHigh
• Container Toolkit / GPU Operator: Container escape to host (insufficient input validation)CVE-2024-0136 · Container Toolkit / GPU OperatorHigh