CVE-2026-65129 is a medium severity (CVSS 6.7) improper certificate validation flaw in NVIDIA Infrastructure Controller for Linux. NVIDIA lists versions 0 to 1.9 as affected and version 2.0 as the update. Move to 2.0 and keep controller traffic on networks you trust until the upgrade is done.
What's affected
NVIDIA's bulletin lists NVIDIA Infrastructure Controller for Linux, versions 0 to 1.9, as affected. The updated version is 2.0. The bulletin says to clone or update the software from the NVIDIA/infra-controller repository on GitHub.
The same bulletin covers a set of Infrastructure Controller issues published together, and this CVE is one row in that table. Its CVSS 3.1 base score is 6.7 (Medium) with the vector CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L. NVIDIA and the record agree on that score, so there is no conflict to report between the two.
The bulletin does not describe the vulnerable code path in detail. NVIDIA's wording is short: an attacker could cause improper certificate validation, which might lead to information disclosure, data tampering, and denial of service.
How to check if you're exposed
Find out whether anyone in your organization runs Infrastructure Controller at all. It is a specialised infrastructure product, so it may live with a platform or data center team rather than in your usual application inventory.
If you do run it, check the installed version against the range above. The bulletin's affected range is 0 to 1.9, so anything older than 2.0 should be treated as in scope. How you read the version depends on how you deployed the software, and the bulletin does not give a command, so use the deployment's own version output or the commit you cloned from the repository.
Also note where the controller sits on your network. The vector marks the attack vector as adjacent with high complexity and low privileges, so an attacker would need a foothold on the same network segment and a basic account. Segmenting the management network lowers that risk.
What to do now
- Inventory every Infrastructure Controller deployment and record its version.
- Update to version 2.0 or later from the NVIDIA/infra-controller repository, following NVIDIA's bulletin.
- Review who holds high privilege accounts on the controller and remove any that are not needed.
- Restrict network access to the controller's management surface to the hosts that must reach it.
- Read the other entries in bulletin 5879, since several were fixed in the same 2.0 release and some carry higher scores.
Why it matters
The weakness class is CWE-295, improper certificate validation. A client that does not check a certificate properly can be talked into trusting the wrong peer. Everything sent afterwards then goes to a party the client never meant to trust.
In practice the vector points to an attacker on the adjacent network, which is why flat management networks matter. The record scores this one a little above the other two Medium entries in this range because confidentiality and integrity impact are both rated high.
The bulletin lists the possible results as information disclosure, data tampering and denial of service. Those are the generic impact categories NVIDIA publishes, not a description of a specific attack. No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Because the bulletin is a batch, the practical path is simple. Move to 2.0, then read the whole table once so you know what else changed.
Quick check
Is this CVE being exploited in the wild?
The record's CISA Known Exploited Vulnerabilities flag is false, and NVIDIA's bulletin does not mention exploitation. Treat it as a patch in your normal cycle, sooner if the controller is reachable from untrusted networks.
Which version fixes it?
NVIDIA lists version 2.0 as the updated version for affected releases from 0 to 1.9. Confirm against the bulletin before you roll out.
Sources
Last reviewed: 18 October 2026.
