CVE-2026-65130 is a high severity (CVSS 8.0) OS command injection flaw in NVIDIA Infrastructure Controller for Linux. NVIDIA lists versions 0 to 1.9 as affected and version 2.0 as the fix. The record says it could lead to code execution, data tampering, denial of service and information disclosure.
What's affected
- Product: NVIDIA Infrastructure Controller for Linux.
- Affected versions: 0 to 1.9, per the NVIDIA bulletin dated 2026-09-22.
- Fixed version: 2.0. NVIDIA says to clone or update the software from the NVIDIA/infra-controller GitHub repository.
- Weakness: CWE-78 OS command injection.
- Severity: CVSS 3.1 vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. Exploitation needs high privileges and the attack complexity is high, which is why the score sits at 8.0 and not higher.
How to check if you're exposed
NVIDIA's bulletin lists affected and fixed versions only. It gives no command, so use your own deployment records.
If you run Infrastructure Controller from a clone of the repository, check which tag you are on:
git -C /path/to/infra-controller describe --tags
git -C /path/to/infra-controller log -1 --format='%H %cd'
If you deploy it from a package, image or internal mirror, look up the version in that artifact's metadata. Anything below 2.0 is in the affected range. If you cannot tell which version is running, treat the host as affected until you can show otherwise.
What to do now
- Find every host that runs NVIDIA Infrastructure Controller and record the version.
- Update to version 2.0 or later from the NVIDIA/infra-controller repository.
- Restart the service after the update and confirm the new version is running.
- Read the NVIDIA bulletin for the other CVEs fixed in the same update, since the bulletin covers several.
- Limit network access to the controller to the management networks that need it until the update is done.
Why it matters
OS command injection happens when input reaches a shell or process launcher without being kept apart from the command itself. The usual fix is to stop building command strings from input, or to validate against a strict allow list.
The vector requires high privileges, so this is not a first step for an anonymous attacker. It matters as a second step. If an administrator account is stolen or abused, a flaw like this turns that access into code execution on the host, and the changed scope suggests the effect can spread to other systems the controller manages. The CISA KEV flag is false and the record reports no exploitation.
Quick check
If it needs high privileges, can I skip it?
Not safely. High privilege requirements lower the odds of a first compromise, but stolen admin credentials are common, and this flaw would raise that access to code execution.
What does the update include?
NVIDIA's bulletin covers several CVEs fixed in the same Infrastructure Controller update, so version 2.0 closes more than this one.
Sources
- NVIDIA product security bulletin 5879 (directory)
- NVIDIA security bulletin text, August 2026
- Gold record for CVE-2026-65130
Last reviewed: 19 October 2026.
