CVE-2026-65126 is a medium severity (CVSS 5.0) improper enforcement of a behavioral workflow in NVIDIA Infrastructure Controller for Linux. NVIDIA lists versions 0 to 1.9 as affected and version 2.0 as the update. Upgrade to 2.0 and limit network reach to the controller while you plan the change.
What's affected
NVIDIA's bulletin lists NVIDIA Infrastructure Controller for Linux, versions 0 to 1.9, as affected. The updated version is 2.0. The bulletin says to clone or update the software from the NVIDIA/infra-controller repository on GitHub.
The same bulletin covers a set of Infrastructure Controller issues published together, and this CVE is one row in that table. Its CVSS 3.1 base score is 5.0 (Medium) with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. NVIDIA and the record agree on that score, so there is no conflict to report between the two.
The bulletin does not describe the vulnerable code path in detail. NVIDIA's wording is short: an attacker could cause improper enforcement of a behavioral workflow, which might lead to data tampering, denial of service, and information disclosure.
How to check if you're exposed
Find out whether anyone in your organization runs Infrastructure Controller at all. It is a specialised infrastructure product, so it may live with a platform or data center team rather than in your usual application inventory.
If you do run it, check the installed version against the range above. The bulletin's affected range is 0 to 1.9, so anything older than 2.0 should be treated as in scope. How you read the version depends on how you deployed the software, and the bulletin does not give a command, so use the deployment's own version output or the commit you cloned from the repository.
Also note where the controller sits on your network. The vector marks the attack vector as network with high complexity, and it requires only low privileges, so any account that can log in to the controller is a starting point. Review who holds accounts and how they are reachable.
What to do now
- Inventory every Infrastructure Controller deployment and record its version.
- Update to version 2.0 or later from the NVIDIA/infra-controller repository, following NVIDIA's bulletin.
- Review who holds high privilege accounts on the controller and remove any that are not needed.
- Restrict network access to the controller's management surface to the hosts that must reach it.
- Read the other entries in bulletin 5879, since several were fixed in the same 2.0 release and some carry higher scores.
Why it matters
The weakness class is CWE-841, improper enforcement of behavioral workflow. Software like this expects actions to happen in a set order, for example authenticate, then request, then act. This class covers cases where the code lets a step happen out of order or skip a step that should have been required.
The record gives a base score of 5.0 with low confidentiality, integrity and availability impact each. That is a modest rating, and it is a good example of an issue you fix because the fix is cheap once you are already moving to 2.0.
The bulletin lists the possible results as data tampering, denial of service and information disclosure. Those are the generic impact categories NVIDIA publishes, not a description of a specific attack. No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Because the bulletin is a batch, the practical path is simple. Move to 2.0, then read the whole table once so you know what else changed.
Quick check
Is this CVE being exploited in the wild?
The record's CISA Known Exploited Vulnerabilities flag is false, and NVIDIA's bulletin does not mention exploitation. Treat it as a patch in your normal cycle, sooner if the controller is reachable from untrusted networks.
Which version fixes it?
NVIDIA lists version 2.0 as the updated version for affected releases from 0 to 1.9. Confirm against the bulletin before you roll out.
Sources
Last reviewed: 18 October 2026.
