CVE-2026-65118 is a high severity (CVSS 7.5) improper certificate validation flaw in NVIDIA Infrastructure Controller for Linux. NVIDIA lists versions 0 to 1.9 as affected and version 2.0 as the fix. A successful attack could expose data, alter it, or cause a denial of service.
What's affected
- Product: NVIDIA Infrastructure Controller for Linux.
- Affected versions: 0 to 1.9, per the NVIDIA bulletin dated 2026-09-22.
- Fixed version: 2.0. NVIDIA says to clone or update the software from the NVIDIA/infra-controller GitHub repository.
- Weakness: CWE-295 improper certificate validation.
- Severity: CVSS 3.1 vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L. The attack vector is the adjacent network and attack complexity is high, so an attacker needs a position close to the controller.
How to check if you're exposed
NVIDIA's bulletin lists affected and fixed versions only. It gives no command, so use your own deployment records.
If you run Infrastructure Controller from a clone of the repository, check which tag you are on:
git -C /path/to/infra-controller describe --tags
git -C /path/to/infra-controller log -1 --format='%H %cd'
If you deploy it from a package, image or internal mirror, look up the version in that artifact's metadata. Anything below 2.0 is in the affected range. If you cannot tell which version is running, treat the host as affected until you can show otherwise.
What to do now
- Find every host that runs NVIDIA Infrastructure Controller and record the version.
- Update to version 2.0 or later from the NVIDIA/infra-controller repository.
- Restart the service after the update and confirm the new version is running.
- Read the NVIDIA bulletin for the other CVEs fixed in the same update, since the bulletin covers several.
- Limit network access to the controller to the management networks that need it until the update is done.
Why it matters
Certificate validation is how a client decides that the server it reached is the one it meant to reach. When that check is incomplete, a party sitting on the network path can pass itself off as the real peer. The record describes the outcome as information disclosure, data tampering and denial of service, which fits that pattern.
The adjacent vector and high complexity keep the score at 7.5. The record does not say the flaw is exploited and the CISA KEV flag is false. For an infrastructure controller, though, the traffic it protects is management traffic, so the impact depends on what the controller manages in your environment.
Quick check
Is this exploited in the wild?
The record's CISA KEV flag is false and NVIDIA's bulletin does not mention exploitation. Treat it as a patching task.
Can a remote attacker on the internet reach this?
The CVSS vector says adjacent network, which means the attacker needs to be on the same network segment or a nearby one. Check where your controller sits.
Sources
- NVIDIA product security bulletin 5879 (directory)
- NVIDIA security bulletin text, August 2026
- Gold record for CVE-2026-65118
Last reviewed: 19 October 2026.
