CVE-2026-24270: NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication

Synopsis

An authentication bypass vulnerability exists in the NVIDIA AIStore framework, affecting all versions up to and including 4.4. The vulnerability is reachable over the network and requires no authentication or user interaction, as indicated by the CVSS vector. Successful exploitation grants an attacker full control over confidentiality, integrity, and availability of the affected system, enabling denial of service, privilege escalation, information disclosure, and data tampering. HarborGuard is tracking the advisory for patch availability and will make a patched-image rebuild available the moment NVIDIA publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the AIStore service over the network; the vulnerability is exposed on any network-accessible deployment.

• AuthenticationNot required

  No credentials or account of any privilege level are required to exploit this vulnerability.

• Victim interactionNot required

  The attacker does not need to trick or involve any user to complete the exploit.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or other environmental factors.

Blast Radius

• A successful attacker reads stored data, credentials, and any secrets accessible to the AIStore process.
• The attacker modifies or deletes persisted objects and metadata within the AIStore data store.
• The attacker crashes or hangs the AIStore service, making distributed storage unavailable to dependent workloads.
• The attacker escalates to higher privilege levels within the AIStore environment, potentially pivoting to other services or host resources.