NVIDIA AIStore framework: Server-side request forgery in experimental HT backend

Summary

NVIDIA AIStore for Linux up to and including version 4.9 contains a server-side request forgery (SSRF) flaw in the experimental HT backend. An unauthenticated remote attacker can supply a crafted original URL that makes the AIStore server send requests to destinations the attacker chooses. The official CVE record rates the impact as partial confidentiality loss (information disclosure) with no integrity or availability impact. Exposure depends on whether the HT backend is enabled and whether the AIStore endpoints are reachable from untrusted networks.

Affected

• NVIDIA AIStore framework, Linux: versions 0 to 4.9 (per the official CVE record; the default is unaffected)
• The flaw is in the experimental HT backend; deployments without this backend enabled should be checked against NVIDIA's bulletin
• CVSS 3.1: 8.6 (High), AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Fixed in

• Vendor fix version: Unknown. NVIDIA's bulletin 5889 could not be retrieved; verify it there.
• Third-party sources state that NVIDIA lists AIStore 5.0 (container image tag v5.0) as the fixed release. This is not confirmed by NVIDIA.
• No backport to a 4.x release has been identified.

Workaround

• No vendor workaround identified.
• If the HT backend is not required, disabling it may reduce exposure. This has not been confirmed by the vendor and must be tested first.
• Restrict network access to AIStore proxy and target endpoints to trusted hosts only.

Exploitation

• CISA SSVC (CVE record): exploitation none, automatable yes, technical impact partial.
• CISA ADP (Vulnrichment) does not mark it as known exploited; verify in the CISA KEV catalog.
• No public proof of concept or exploitation reports found in a short search.

Our recommendation

• Check whether any AIStore version 4.9 or lower is in use, including test and internal systems.
• Upgrade to the fixed release named in NVIDIA's bulletin (third-party sources indicate 5.0). Plan for configuration changes, because 5.0 introduces breaking changes.
• Until the upgrade is done, restrict access to AIStore endpoints to trusted networks and disable the HT backend if it is not needed, after testing.
• Monitor AIStore nodes for unexpected outbound requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• NVIDIA Security Bulletin 5889 (GitHub) github.com
• NVD: CVE-2026-65170 nvd.nist.gov
• CVE Record: CVE-2026-65170 www.cve.org
• CISA ADP Vulnrichment mirror hol.org
• Strix: CVE-2026-65170 www.strix.ai
• AIStore releases (GitHub) github.com
• Qovery: AIStore CVE exposure check and remediation www.qovery.com
• SecurityOnline: NVIDIA AIStore vulnerabilities securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:33.