CVE-2026-65117 is a medium severity (CVSS 5.0) use of a hard-coded password in NVIDIA Infrastructure Controller for Linux. An attacker on an adjacent network could tamper with data, disrupt service or read information. NVIDIA's bulletin says versions 0 to 1.9 are affected and 2.0 fixes it.
What's affected
The NVIDIA bulletin lists NVIDIA Infrastructure Controller on Linux with affected versions 0 to 1.9 and updated version 2.0. The weakness is CWE-259 (use of hard-coded password). The record and the bulletin agree on the 5.0 score. The record also lists the Linux kernel among its products. The bulletin shows the vulnerable software is the NVIDIA product on Linux, not the kernel itself.
The vector is adjacent network, high complexity, no privileges and no user interaction, with low impact on confidentiality, integrity and availability. In other words the attacker must be on the same network and must work to use it, but a hard-coded secret is the same on every install.
The same bulletin lists 14 CVEs for this product, so a single upgrade to 2.0 addresses a group of them.
How to check if you're exposed
Check the version of Infrastructure Controller on each host.
dpkg -l 2>/dev/null | grep -i infra
rpm -qa 2>/dev/null | grep -i infra
The exact package name depends on how NVIDIA ships it, so use your own inventory or the product's version output. Anything up to 1.9 is affected. Also work out which hosts can reach the controller from an adjacent network, since that is the attacker position in the vector.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Find every Infrastructure Controller deployment and its version.
- Upgrade to version 2.0 or later, as the bulletin directs.
- Restrict network access to the controller to management hosts, using VLANs or firewall rules.
- After upgrading, check whether any credentials related to the product need rotating, using NVIDIA's guidance.
- Review the other CVEs in bulletin 5879 and confirm the upgrade covers them.
Why it matters
A hard-coded password is a secret baked into the software. Everyone who has the product has the password, and once it is found in one copy it works on all of them. It cannot be rotated by the customer, only fixed by the vendor.
The class is CWE-259. The adjacent network vector limits exposure to local segments, which is why this is rated medium. The record does not list the CVE as exploited in the wild.
Quick check
Can I change the hard-coded password myself?
Not by design. The fix is the vendor update to 2.0, and the bulletin is the place to check for any extra steps.
Sources
Last reviewed: 18 October 2026.
