NVIDIA AIStore: experimental HT backend fetches a crafted original URL (SSRF)

Impact

The experimental HT backend takes an 'original URL' from the request and fetches it, letting an unauthenticated caller use AIStore as a proxy into the cluster's internal network. The server-side fetch runs with the storage tier's network position, so it reaches node metadata services and internal management endpoints that are not exposed to tenants, and the response comes back to the attacker. NVIDIA scores it 8.6 with a scope change. Separate from the dSort key-map SSRF (CVE-2026-65101) - different backend, different request path, and only deployments that enabled the experimental HT backend are exposed.

Who can reach it

Network-reachable, unauthenticated, no user interaction: any client that can reach the AIStore HT backend endpoint.

What to do

If the experimental HT backend is not in use, disable it - that removes the exposure without a maintenance window. Otherwise update AIStore per NVIDIA advisory 2026/5889 and restart the AIStore daemons; the record gives no fixed version. Also restrict egress from AIStore pods and block access to the cloud metadata endpoint.

References

Related entries

• NVIDIA AIStore: ETL management API missing authorization on job read and start/stopCVE-2026-65172 · NVIDIA AIStore (ETL management API, proxy GET/POST)High
• rclone (serve restic): Path validation in serve restic is incomplete, so an authenticated caller escapes the configuredCVE-2026-71309 · rclone (serve restic)High
• LibreNMS: device hostname is concatenated into shell commands in libvirt discovery, giving RCECVE-2026-84194 · LibreNMS libvirt VM discovery (VminfoLibvirt.php)High
• Dell Terraform Provider for OME: API client error handling exposes sensitive informationCVE-2026-91882 · Dell Terraform Provider for OpenManage Enterprise (API client error handling)High
• VMware Aria Automation (SQL injection): An authenticated user injects SQL and performs unauthorized read/writeCVE-2024-22280 · VMware Aria Automation (SQL injection)High
• Juniper Security Director Policy Enforcer: unauthenticated attacker can replace vSRX images pushed to VMware NSXCVE-2025-11198 · Juniper Security Director Policy Enforcer (vSRX image upload)High