Database/Control plane, storage & DevOps

NVIDIA AIStore: path traversal in target-side object rename writes files outside the bucket

CVSS 8.1CVE-2026-65103Control plane, storage & DevOpscurated

Impact

Submitting a crafted rename destination directly to an AIStore target escapes the bucket directory and creates or overwrites arbitrary files that the target process can write. On a storage node that means overwriting AIStore's own configuration or anything else writable by the daemon's user, which NVIDIA says may lead to code execution and privilege escalation as well as data tampering and denial of service. The blast radius is the storage tier that every GPU job in the cluster reads its datasets from. NVIDIA rates attack complexity high (8.1), so exploitation is not trivial, but it needs no credentials. Distinct from the dSort extraction traversal in CVE-2026-65164: different handler and a different way in.

Who can reach it

Network-reachable, unauthenticated: the attacker must be able to send a request directly to an AIStore target, bypassing the proxy. Tenants with cluster network access to target pods qualify.

What to do

Update AIStore per NVIDIA advisory 2026/5889 and restart the AIStore target daemons. No fixed version appears in the record. Until then, make sure target ports are reachable only from the AIStore proxies and the control plane, not from tenant workloads - direct target access is the precondition here.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-65103 https://github.com/NVIDIA/product-security/tree/main/2026/5889

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.