NVIDIA AIStore: Unsafe Kubernetes PodSpec settings in legacy ETL API
Summary
NVIDIA AIStore's legacy ETL API accepts Kubernetes PodSpec settings from the caller, including host namespace and container security settings. A remote attacker can use this to run workloads with elevated rights, which may enable code execution, privilege escalation, information disclosure, data tampering and denial of service. The CVSS score is 10.0 (critical) and no authentication is required, but actual exposure depends on whether the ETL API is reachable from untrusted networks.
Affected
- NVIDIA AIStore framework versions 0 through 4.9 (official CVE record)
- Versions outside this range: unaffected according to the CVE record
Fixed in
- Upgrade to AIStore 5.0 (according to secondary sources citing NVIDIA bulletin 5889; not yet verified against the bulletin)
Workaround
- No vendor workaround known.
- Interim measures: restrict network access to AIStore and block privileged pods and host namespaces with admission policies (recommendation from secondary sources).
Exploitation
- CISA SSVC: Exploitation: none, automatable: yes, technical impact: total.
- Not marked as known exploited in the sources reviewed.
- Public proof of concept: none found; status unknown.
Our recommendation
- Check whether AIStore is present, especially versions 4.9 or earlier, including Helm charts and container tags.
- Plan the upgrade to 5.0 following NVIDIA bulletin 5889, and note the upgrade caveats reported by secondary sources.
- Until patched, restrict network access to AIStore and block privileged pods and host namespaces.
- Review the cluster for pods created through the ETL API that use host namespaces or privileged settings.
- Recheck the NVD record and the NVIDIA bulletin for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVIDIA Security Bulletin 5889 github.com
- NVD: CVE-2026-65162 nvd.nist.gov
- CVE Record: CVE-2026-65162 www.cve.org
- Qovery: AIStore PodSpec CVE exposure check and remediation www.qovery.com
- SecurityOnline: NVIDIA AIStore vulnerabilities CVE-2026-65162 securityonline.info
- DEV: AIStore legacy ETL API accepted Kubernetes security settings dev.to
- HOL: CISA ADP Vulnrichment for CVE-2026-65162 hol.org
- Strix: CVE-2026-65162 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:26.
Original description (NVD)
NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.