What changed
On 13 October 2026 NVIDIA published security bulletin 5889 for the AIStore framework. The bulletin says versions 0 through 4.9 are affected and tells operators to install AIStore 5.0 from the NVIDIA/aistore repository on GitHub. The initial revision of the bulletin is 1.0.0, dated 13 October 2026.
Eight CVE records are in the table. Two are rated critical. CVE-2026-65162 scores 10.0. NVIDIA describes it as a flaw in the legacy ETL Kubernetes PodSpec initialization API: a remote attacker may supply Kubernetes host namespace and container security settings, with impacts that include code execution, privilege escalation, information disclosure, data tampering, and denial of service. The weakness is CWE-250. CVE-2026-65173 scores 9.1. It is missing authentication on the token revocation endpoint, so an unauthenticated remote attacker may submit crafted token revocation lists. NVIDIA lists data tampering and denial of service. The weakness is CWE-306.
Three high severity issues score 8.6. CVE-2026-65172 is missing authorization on the ETL management API. An unauthenticated remote attacker may read ETL information or start and stop existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. CVE-2026-65170 is server side request forgery in the experimental HT backend via a crafted original URL. CVE-2026-65101 is server side request forgery in the distributed sort component via a crafted external key map URL. Both forgery issues are CWE-918 and are described as information disclosure.
Two path traversal issues score 8.1. CVE-2026-65164 is in dSort archive extraction: crafted archive member names may create or overwrite files. CVE-2026-65103 is in the target side object rename handler: a crafted rename destination sent directly to an AIStore target may create or overwrite a file. CVE-2026-65161 scores 7.5. The Promote API may let an unauthenticated remote attacker read files the target process can read, by supplying a crafted absolute source path.
NVIDIA credits Mohamed Lemine Ahmed Jidou for CVE-2026-65162. Habibullo Izzatilloyev, working with TrendAI Zero Day Initiative, is credited for CVE-2026-65170 and CVE-2026-65101. Mat Powell of TrendAI Zero Day Initiative is credited for CVE-2026-65103. George Chen and Rocco Calvi of TecSecurity, with TrendAI Zero Day Initiative, and Facundo Fernandez are credited for CVE-2026-65161.
The GitHub release titled 5.0, tag v1.5.0, was published on 21 August 2026. Its notes call 5.0 a mandatory bridge: a 4.x cluster must pass through 5.0. The release titled 5.1, tag v1.5.1, was published on 28 September 2026. Those notes say 5.1 closes the two release security rollout opened by 5.0, removes the bridge gate, and refuses pre 5.0 nodes. Bulletin 5889, dated after that tag, still names 5.0 as the version to install.
Image: NVIDIA AIStore
Why it matters
AIStore is the storage layer under training and batch jobs. The critical records do not require a logged in user. A proxy that is reachable from a network an attacker can already touch is enough for the ETL and token revocation issues as NVIDIA describes them. Stopping or starting ETL jobs changes which data a pipeline processes. A token revocation list an outsider can submit can knock legitimate clients off the cluster. The PodSpec issue is the one NVIDIA scores at 10.0, and it reaches from the cluster into Kubernetes host settings.
Who is affected
Operators of NVIDIA AIStore on Linux, including clusters on Kubernetes, on versions the bulletin lists as 0 through 4.9. Teams that let training jobs, feature stores, or ETL pipelines read and write through an AIStore proxy.
What to do next
Read bulletin 5889 and the 5.0 and 5.1 release notes before choosing a build. The bulletin's instruction is to install 5.0. The 5.1 notes describe a later step that removes the bridge and refuses older nodes. Plan the bridge rather than a skip from 4.x to whatever tag is newest on the default branch. After the move, confirm the proxy is not open to networks that do not need it, and retest ETL jobs, token revocation, and promote operations that your pipelines actually use. Treat the credits and CVE identifiers as the checklist, not a single patch Tuesday line.
What to watch
Whether NVIDIA revises bulletin 5889 above revision 1.0.0, and whether a later note names 5.1 as the required build instead of 5.0. Also watch for proof of concept detail beyond the bulletin table. None is in the 13 October text.
Image: NVIDIA AIStore
Sources
Primary — NVIDIA, Security Bulletin: NVIDIA AIStore Framework, October 2026 (13 October 2026). Establishes the affected range 0 through 4.9, the instruction to install 5.0, and the eight CVE descriptions, scores, and credits.
Secondary — NVIDIA, AIStore 5.0 release (21 August 2026). Establishes that 5.0 is the mandatory bridge out of 4.x.
Secondary — NVIDIA, AIStore 5.1 release (28 September 2026). Establishes the later claim that 5.1 closes the security rollout opened by 5.0.
Related in Cyber Security
Continue reading