NVIDIA GEN3C (Spatial Intelligence Lab) inference API server: The inference API server runs Python pickle.loads()

Impact

The inference API server runs Python pickle.loads() directly on raw HTTP request bodies at /request-inference and /seed-model, with no authentication in front of either. Anyone who can reach the port executes arbitrary code as the inference process - which is the process that holds the GPU, the model weights on disk, and whatever cloud credentials the pod was handed. There is no escalation step and no credential to steal first; the attacker is inside the serving process on the first request. On a shared cluster this also becomes a lateral-movement path, because any neighbouring pod that can route to the service gets the same unauthenticated shell.

Who can reach it

Network reach to the GEN3C inference API port. No account, no credentials, no user interaction, low complexity. In practice that means every pod on the cluster network, plus the public internet wherever the service was fronted by a LoadBalancer or a permissive NodePort. Nothing about the endpoint signals that it is dangerous, so it tends to be left open on the assumption that it is internal.

What to do

There is no NVIDIA PSIRT bulletin and no fixed release tag for this - GEN3C is a research repository, so the fix exists only as upstream commits (pull requests 62 and 63, commit db2ffe12). Rebuild your image from a revision that includes that commit and redeploy the service. Because there is no version to pin, treat this as a supply-chain check rather than a patch: pin the commit hash in your build and re-verify it. Immediately and regardless of patching, put the inference port behind an authenticated proxy and a network policy - do not leave it reachable from general cluster traffic.

References