CVE-2024-0132 is a critical (CVSS 9.0) time-of-check time-of-use flaw in NVIDIA Container Toolkit 1.16.1 and earlier. With the default configuration, a specially crafted container image can reach the host file system. NVIDIA fixed it in Container Toolkit 1.16.2 and GPU Operator 24.6.2.
What's affected
NVIDIA bulletin 5582 lists two products on Linux:
- NVIDIA Container Toolkit: all versions up to and including 1.16.1. Fixed in 1.16.2.
- NVIDIA GPU Operator: all versions up to and including 24.6.1. Fixed in 24.6.2.
The bulletin says the issue is in the default configuration and that it does not affect use cases where the Container Device Interface (CDI) is used. The record also lists the Linux kernel as a platform, but the vulnerable component is the toolkit.
How to check if you're exposed
On each GPU host, check the toolkit version.
nvidia-ctk --version
nvidia-container-cli --version
Anything at 1.16.1 or earlier is in range. For Kubernetes, check the GPU Operator Helm release and the toolkit image it deploys.
helm list -A | grep -i gpu-operator
Also check whether your runtime is configured to use CDI, since the bulletin says CDI use cases are not affected. Do not treat CDI as a reason to skip the upgrade until you have confirmed it is in use on every node.
What to do now
- Inventory every node that runs GPU containers, including CI runners and ML training hosts.
- Upgrade NVIDIA Container Toolkit to 1.16.2 or later, and GPU Operator to 24.6.2 or later.
- Until patched, run only images you build and trust on affected nodes. Block pulls from public registries.
- Review who can start containers on GPU nodes and what images they can pull.
- Verify versions after the rollout, and rescan hosts and images.
Why it matters
The weakness is CWE-367, time-of-check time-of-use. A program checks a condition, such as a path, and then acts on it later. If an attacker can change the thing in between, the action lands somewhere the check never approved. Here the result is access from a container to the host file system, which breaks the isolation containers are supposed to give.
NVIDIA lists code execution, denial of service, escalation of privileges, information disclosure and data tampering as outcomes. The CVSS vector is network, low complexity, low privileges, with user interaction and a changed scope. The record does not mark this as exploited in the wild, and it is not flagged in CISA KEV in the record. Multi-tenant GPU clusters that run images from many sources are the place to patch first. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does CDI make me safe?
NVIDIA says the issue does not affect use cases where CDI is used. Confirm CDI is actually in use on every node, and upgrade anyway.
Which versions are fixed?
Container Toolkit 1.16.2 and GPU Operator 24.6.2, per NVIDIA bulletin 5582.
Sources
Last reviewed: 19 October 2026.
