CVE-2026-65114 is a high severity (CVSS 8.3) missing authentication flaw for a critical function in NVIDIA Infrastructure Controller for Linux. NVIDIA's bulletin lists versions 0 to 1.9 as affected and 2.0 as the update. The attack vector is the adjacent network, so limit who shares that network.
What's affected
- Product: NVIDIA Infrastructure Controller for Linux.
- Affected versions per NVIDIA's bulletin: 0 to 1.9. Updated version: 2.0.
- Weakness: CWE-306, missing authentication for a critical function. CVSS 8.3 (high), vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. - NVIDIA lists data tampering, denial of service and information disclosure as impacts. Its instruction is to clone or update from the NVIDIA/infra-controller GitHub repository.
How to check if you're exposed
Find where Infrastructure Controller is installed and which release it is on.
cd /path/to/infra-controller
git describe --tags 2>/dev/null
git log -1 --format=%H
Anything on 1.9 or earlier is in range. Then check the network. The vector is adjacent, so the exposure depends on which hosts share a network segment or broadcast domain with the controller.
What to do now
- Find every Infrastructure Controller deployment and its release.
- Update to 2.0 from the official NVIDIA repository.
- Isolate the controller on a management network, and allow only the hosts that must reach it.
- Read the full bulletin. It lists other issues for this product on the same date, including hard coded credentials and SQL injection, so one update should cover them together.
Why it matters
The weakness is CWE-306: a function that matters does not ask who is calling. On an infrastructure controller that can be serious, because it manages other systems. The adjacent vector means the attacker needs to be on the same network segment, which rules out the open internet but not a compromised host next door.
NVIDIA rates the effect high for integrity and availability. The record's KEV flag is false, and the bulletin does not describe attacks.
Quick check
What does adjacent mean?
The attacker has to be on the same network segment or a closely connected one, not anywhere on the internet.
What fixes it?
NVIDIA lists version 2.0.
Sources
Last reviewed: 19 October 2026.
