WEKA Data Platform and VAST Data (published-advisory coverage): Neither WEKA nor VAST Data

Impact

Neither WEKA nor VAST Data — two of the most commonly deployed storage platforms under large AI training clusters — has a meaningful public CVE record. NVD keyword searches return nothing attributable to either product. As with community SONiC, this is an absence of disclosure rather than an absence of vulnerabilities: both are complex distributed systems with kernel-level clients, RDMA data paths and multi-tenant namespace separation, and comparable platforms (Lustre, Spectrum Scale, Ceph, BeeGFS) all have significant published histories including cross-tenant access-control failures. An operator running WEKA or VAST has no external feed telling them when to patch the layer that holds every tenant's training data.

Who can reach it

Not a specific vulnerability. The exposure is that these platforms' security posture is visible only to the vendor, so an operator's patch decisions depend entirely on vendor-issued release notes and on asking directly.

What to do

No patch. Make it contractual and operational: require the vendor to notify you of security-relevant fixes in release notes and to state a disclosure policy; ask for their most recent third-party penetration-test summary at renewal; keep the storage cluster's management plane on an isolated network; and verify multi-tenant namespace separation yourself with an actual cross-tenant read test rather than trusting the product claim. Track the kernel-client packages these platforms install, since those inherit Linux CVEs on your normal patch cycle even when the platform itself publishes nothing.

References

Related entries

• BACnet / BACnet IP as a protocol (facility control plane): BACnet has no authentication, no integrity protection and noNCVD-2026-024-bacnet-bacnet-ip-as-a-protocol-f · BACnet / BACnet IP as a protocol (facility control plane)Unscored
• NVMe-oF fabric authentication as deployed - host NQN allowlisting on Linux nvmet, SPDK and most storage appliancesNCVD-2026-024-nvme-of-fabric-authentication-as · NVMe-oF fabric authentication as deployed - host NQN allowlisting on Linux nvmet, SPDK and most storage appliancesUnscored
• Landlord-owned facility control network in a leased colo or wholesale hall (governance gap): Almost every neocloudNCVD-2026-025-landlord-owned-facility-control · Landlord-owned facility control network in a leased colo or wholesale hall (governance gap)Unscored
• SES (SCSI Enclosure Services) enclosure management on shared SAS JBODs and expanders: SES is how a host controlsNCVD-2026-026-ses-scsi-enclosure-services-encl · SES (SCSI Enclosure Services) enclosure management on shared SAS JBODs and expandersUnscored
• Modbus TCP as an unauthenticated control channel on facility gear: Modbus TCP has no authentication, no authorizationNCVD-2026-027-modbus-tcp-as-an-unauthenticated · Modbus TCP as an unauthenticated control channel on facility gearUnscored
• Wiegand reader-to-controller wiring and legacy 125 kHz proximity / MIFARE Classic credentials: Two structuralNCVD-2026-033-wiegand-reader-to-controller-wir · Wiegand reader-to-controller wiring and legacy 125 kHz proximity / MIFARE Classic credentialsUnscored