CVE-2026-65121 is a high severity (CVSS 8.2) improper authentication flaw in NVIDIA Infrastructure Controller for Linux. NVIDIA lists versions 0 to 1.9 as affected and version 2.0 as the fix. The record says a successful attack could lead to privilege escalation, information disclosure and data tampering.
What's affected
- Product: NVIDIA Infrastructure Controller for Linux.
- Affected versions: 0 to 1.9, per the NVIDIA bulletin dated 2026-09-22.
- Fixed version: 2.0. NVIDIA says to clone or update the software from the NVIDIA/infra-controller GitHub repository.
- Weakness: CWE-287 improper authentication.
- Severity: CVSS 3.1 vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. The vector is adjacent network, low complexity, no privileges and no user interaction, with a changed scope.
How to check if you're exposed
NVIDIA's bulletin lists affected and fixed versions only. It gives no command, so use your own deployment records.
If you run Infrastructure Controller from a clone of the repository, check which tag you are on:
git -C /path/to/infra-controller describe --tags
git -C /path/to/infra-controller log -1 --format='%H %cd'
If you deploy it from a package, image or internal mirror, look up the version in that artifact's metadata. Anything below 2.0 is in the affected range. If you cannot tell which version is running, treat the host as affected until you can show otherwise.
What to do now
- Find every host that runs NVIDIA Infrastructure Controller and record the version.
- Update to version 2.0 or later from the NVIDIA/infra-controller repository.
- Restart the service after the update and confirm the new version is running.
- Read the NVIDIA bulletin for the other CVEs fixed in the same update, since the bulletin covers several.
- Limit network access to the controller to the management networks that need it until the update is done.
Why it matters
Improper authentication means the system does not reliably confirm who is asking before it acts. Here the score is driven by the fact that the attacker needs no account and no user action, only a position on the adjacent network.
The changed scope in the vector means the impact can reach beyond the controller itself. That fits a component whose job is to manage other systems. The record does not describe the mechanism, and the bulletin adds no detail, so I will not guess at it. The CISA KEV flag is false and no exploitation is reported.
Quick check
Does this need a valid account?
No. The vector says privileges required: none. That is why the fix should not wait for the next maintenance window.
Where do I find the fixed release?
NVIDIA points to the NVIDIA/infra-controller GitHub repository and lists version 2.0 as the updated version.
Sources
- NVIDIA product security bulletin 5879 (directory)
- NVIDIA security bulletin text, August 2026
- Gold record for CVE-2026-65121
Last reviewed: 19 October 2026.
