NVIDIA AIStore: legacy ETL API lets a remote caller set host namespaces and container security context

Impact

AIStore is the dataset store that feeds training and inference jobs, and its ETL feature runs user transforms as pods on the cluster. The legacy ETL PodSpec initialization API accepts attacker-supplied Kubernetes host-namespace and container-security settings, so whoever can reach the AIStore endpoint can ask for a transform pod with hostPID/hostNetwork or a privileged security context and get code execution on the node that runs it. On a GPU cluster that is a break out of the storage tier into the node that holds other tenants' pods and the accelerators they are using, with privilege escalation, disclosure of data on the host, tampering and denial of service all following from it. NVIDIA scores it 10.0 with a scope change, i.e. the compromise does not stay inside AIStore.

Who can reach it

Network-reachable, no authentication and no user interaction: anyone who can send requests to the AIStore ETL API. In most deployments that means anyone on the cluster network or any tenant pod that can route to the AIStore proxy.

What to do

Update AIStore per NVIDIA advisory 2026/5889 and restart the AIStore proxy and target daemons (a rolling restart of the AIStore pods on Kubernetes). The record does not name a fixed version, so take it from the advisory. Until then, keep the AIStore API off any tenant-reachable network, and disable the legacy ETL PodSpec initialization path if your deployment does not use it; cluster-side, a PodSecurity admission policy that rejects host namespaces and privileged containers limits what a crafted PodSpec can ask for.

References

Related entries

• Linux crypto driver for Marvell OCTEON TX: The scatter-gather cleanup path in the Marvell OCTEON TX crypto driver usesCVE-2026-74280 · Linux crypto driver for Marvell OCTEON TXCritical
• Linux VXLAN driver (neighbour hardware address read in route_shortcircuit): `route_shortcircuit()` reads a neighbour'sCVE-2026-74475 · Linux VXLAN driver (neighbour hardware address read in route_shortcircuit)Critical
• Cisco ISE: unauthenticated API endpoint allows full authentication bypass on the applianceCVE-2026-76460 · Cisco Identity Services Engine (unauthenticated API endpoint)Critical
• SonicWall SMA1000: pre-auth SSRF via an unintended alternate access path in the Work Place interfaceCVE-2026-83548 · SonicWall SMA1000 appliance (Work Place interface, alternate access path)Critical
• GitLab: unauthenticated arbitrary file read via the repository commits APICVE-2026-85706 · GitLab CE/EE (repository commits API)Critical
• GitLab CE/EE: crafted CI/CD regex lets an unauthenticated user run code on the GitLab serverCVE-2026-97229 · GitLab CE/EE (CI/CD configuration regular-expression validation)Critical