CVE-2026-65124 is a medium severity (CVSS 5.9) XML injection flaw in NVIDIA Infrastructure Controller for Linux. An attacker with high privileges could tamper with data or cause denial of service. NVIDIA's bulletin says versions 0 to 1.9 are affected and version 2.0 fixes it.
What's affected
The NVIDIA bulletin lists NVIDIA Infrastructure Controller on Linux with affected versions 0 to 1.9 and updated version 2.0. The weakness is CWE-91 (XML injection, also called blind XPath injection). Record and bulletin agree on the 5.9 score. The record also lists the Linux kernel among its products. The bulletin shows the vulnerable software is the NVIDIA product on Linux, not the kernel itself.
The vector is network based with high complexity and high privileges required, no user interaction, and high impact on integrity and availability with no confidentiality impact. The privilege requirement means the attacker needs an account with significant rights first.
The bulletin covers 14 CVEs for this product, so the 2.0 upgrade handles several at once. A sibling, CVE-2026-65117, concerns a hard-coded password.
How to check if you're exposed
Check the installed version of Infrastructure Controller on each host.
dpkg -l 2>/dev/null | grep -i infra
rpm -qa 2>/dev/null | grep -i infra
Versions up to 1.9 are affected. Then check who holds privileged accounts on the controller, since the vector requires them, and review how those accounts are protected.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Inventory Infrastructure Controller instances and versions.
- Upgrade to 2.0 or later per the bulletin.
- Reduce the number of accounts with high privileges, and require strong authentication for them.
- Restrict network access to the management interface.
- Review audit logs for unusual configuration changes before the upgrade.
Why it matters
XML injection occurs when input is placed inside an XML document or query without escaping, so the input can change the structure instead of just supplying data. In a controller that reads configuration from XML, a changed structure can change behaviour or break parsing.
The class is CWE-91. Requiring high privileges keeps the score at medium, but privileged accounts are exactly what attackers target after a first foothold. The record does not list the CVE as exploited in the wild.
Quick check
Does it need valid credentials?
The vector requires high privileges, so the attacker needs an account with significant rights on the product.
Sources
Last reviewed: 18 October 2026.
