al-ice.ai

The Fix Shipped in August, the CVE Arrived in October: NVIDIA’s 18-CVE AI-Stack Batch

AI Vulnerabilities & CVEs by al-ice.ai Editorial

NVIDIA PSIRT published six security bulletins on 13 October 2026, each marked Revision 1.0.0 — Initial Release, covering 18 CVEs across the company’s open-source AI stack: the AIStore object store (8), Megatron-LM (3), DALI (4), NVSentinel (1), Isaac Lab (1) and Warp (1). The headline number is CVE-2026-65162, a CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, CWE-250) in AIStore’s legacy ETL Kubernetes Pod-spec initialization API, where “a remote attacker may supply Kubernetes host-namespace and container-security settings.” All 18 records landed at NVD the same afternoon with vulnStatus: Awaiting Analysis, carrying NVIDIA’s own CVSS 3.1 scores.

The interesting part is not the 10.0. It is that not one of these bulletins announces a new release. We checked every “Updated Version” cell in all six bulletins against the publication timestamp of the matching upstream tag, read first-hand from the GitHub API. Every fix was already public, by between a month and half a year:

  • Megatron-LM 0.17.0 (fix for CVE-2026-65180, CWE-502 checkpoint deserialisation) — tag core_v0.17.0, 16 April 2026: 180 days before the bulletin.
  • Megatron-LM 0.17.1 (CVE-2026-65110, a second checkpoint-loading RCE, and CVE-2026-65104, hash collisions in the inference cache) — core_v0.17.1, 28 May 2026: 138 days.
  • Isaac Lab 3.0-beta2 (CVE-2026-65141, CWE-95 eval injection) — v3.0.0-beta2, 17 June 2026: 118 days.
  • Warp 1.16.0 (CVE-2026-67456, heap overflow) — v1.16.0, 3 August 2026: 71 days.
  • AIStore 5.0 (all eight AIStore CVEs) — tag v1.5.0, release named “5.0”, 21 August 2026: 53 days.
  • NVSentinel 1.20.0 (CVE-2026-65131, unauthenticated gRPC health-event socket) — v1.20.0, 24 August 2026: 50 days.
  • DALI 2.3 (CVE-2026-65147 through 65150, four memory-safety bugs) — v2.3.0, 28 August 2026: 46 days.

None of those releases mentions a CVE identifier, because none existed yet. That is not misconduct — assignment follows its own clock, and NVIDIA is publishing the records rather than sitting on them. But it does determine what the bulletin is actually for. For six separate projects, the security content of a release was legible in October and invisible in August, and the population that upgraded in between did so for unrelated reasons.

The release notes said it; they just didn’t say “CVE”

AIStore is the clearest case, because its 5.0 notes describe the fixes in plain prose. Under a section headed Security, Reliability, and Correctness, the notes state that “Several of the problems in this section were reported to us privately” and then enumerate them. Three lines map one-to-one onto bulletin entries:

  • “dSort external key-map URLs can no longer reach loopback, private, link-local, unspecified, or multicast destinations” — this is CVE-2026-65101 (8.6, CWE-918, SSRF via a crafted external key map URL in distributed sort).
  • “Promote sources are now restricted to absolute paths beneath /var/lib/ais/promote” — this is CVE-2026-65161 (7.5, CWE-22, unauthenticated file read via the Promote API).
  • “Targets now validate object names independently for GET, PUT, HEAD, DELETE, and PATCH… Object names, virtual-directory prefixes, and archive paths are rejected when they could escape an AIS mountpath” — the surface behind CVE-2026-65103 (8.1, target-side rename traversal) and CVE-2026-65164 (8.1, dSort archive-member traversal).

The 5.0 ETL section adds “ETL management operations enforce authorization,” which is CVE-2026-65172 (8.6, CWE-862). The project even credits reporters by name in its own acknowledgements — including a promote-path report from @geo-chen (commit e2c709706) that corresponds to the bulletin’s credit line for CVE-2026-65161. The information was there. The identifier was not, and identifiers are what scanners, SBOM pipelines and change-advisory boards consume.

For the 10.0, the version the bulletin names is not the version that removes it

This is the finding that changes someone’s afternoon. The AIStore bulletin’s remediation instruction reads: “download and install the 5.0 version of the NVIDIA AIStore framework,” and the affected-version table lists 0 to 4.9 → 5.0 for all eight CVEs, including the 10.0. We read ext/etl/api.go at three tags to see what 5.0 actually did to the Pod-spec path:

  • At v1.4.9: InitSpecMsg — the full-Pod-spec initialisation message — is present, parsed and validated, with no deprecation marker.
  • At v1.5.0 (“5.0”): InitSpecMsg is still present, still parsed, still validated. It gains a comment: “Deprecated: Kubernetes Pod spec ETL initialization will be removed in v5.1. Use ETLSpecMsg instead.” The commit that introduced it (14a0bdde4, 25 July 2026) is explicit in its own message: “keep supporting Pod specs init unchanged with prominent warning; plan to remove Pod specs init completely in v5.1.” It touches seven files and adds warnings and documentation; it changes no behaviour.
  • At v1.5.1 and at main today: InitSpecMsg is gone. All that survives is a constant comment, SpecType = "spec" // persisted InitSpecMsg discriminator (removed in v5.1). The removal is commit 739fcca2f, 25 August 2026 — four days after 5.0 shipped — and the 5.1 notes list it under “Removed in v5.1”: “Kubernetes Pod-spec ETL initialization (InitSpecMsg, CLI Pod-spec parsing, Python Etl.init_spec(), and bundled Pod templates) is removed.”

Two qualifications, because they matter. First, 5.0 does reduce exposure for most operators by a different route: ETL now sits behind an etl build tag and “is excluded from default builds,” with separate -etl images published alongside the default. A default 5.0 build has no ETL subsystem at all. Second, the 5.0 notes are candid about why the feature is going away: “deprecate full Pod specs because Kubernetes-level controls create privilege-escalation and node-compromise risks” — which is, almost word for word, the impact statement later attached to a 10.0.

But the practical reading stands: an operator who follows the bulletin literally, installs an ETL-enabled 5.0 and stops, still runs the API the CVSS 10.0 describes. 5.1 — released 28 September, fifteen days before the bulletin — is the version that removes it, and the bulletin does not mention 5.1. AIStore 5.0 is also not a drop-in upgrade: its own notes call it “a mandatory bridge” that changes persisted cluster metadata and the intra-cluster trust model, and “a 4.x cluster must pass through 5.0 on the way to 5.1.” The remediation for a 10.0 here is a two-step major-version migration, not a patch.

One fix exists only in a beta, one project is seven releases past the fix

The Isaac Lab entry has the opposite problem. CVE-2026-65141 (7.8, CWE-95 eval injection) lists affected versions 0.0–2.3.2 and updated version 3.0-beta2. The matching tag, v3.0.0-beta2, is a 3.0 pre-release line; the last 2.x release, v2.3.2, shipped 2 February 2026 and is itself the top of the affected range. There is no patched 2.x. A team standardised on the stable line is being pointed at a beta — the same shape we noted for orb/sandboxed.sh, where the fix existed only ahead of any tagged release.

NVSentinel shows the inverse: it ships weekly, and its v1.20.0 notes describe the fix without naming it — the release “authenticates health-event publishers and binds each event to its reporting node,” which is exactly CVE-2026-65131’s unauthenticated gRPC health-event interface. The project reached v1.27.0 on 12 October, the day before the bulletin. Anyone on a current NVSentinel was fixed seven releases ago and never knew there had been something to fix.

Megatron-LM carries the quietest risk in the batch. Two of its three CVEs — CVE-2026-65110 and CVE-2026-65180, both 7.8, both CWE-502 — are checkpoint-loading RCEs: “an attacker could cause an RCE by convincing a user to load a maliciously crafted file.” Loading someone else’s checkpoint is not an exotic act in this ecosystem; it is the normal mode of a model hub. The fixes are in 0.17.0 and 0.17.1, from April and May; the project is now on core_v0.19.2.

What to do

  • AIStore: go to 5.1, not 5.0. 5.0 remediates seven of the eight CVEs but leaves the Pod-spec ETL init API present and functional; 5.1 removes it. If you must sit at 5.0 as the migration bridge, build without the etl tag (the default) or keep ETL-enabled images off any network an untrusted caller can reach, and note that persisted legacy ETLs are discarded on the 5.1 upgrade.
  • Megatron-LM: treat checkpoints as code. Two CWE-502 records against checkpoint loading mean the file format is an execution boundary. Pin to 0.17.1 or later, and load third-party checkpoints only in a container you are willing to lose.
  • Isaac Lab: there is no fixed stable release. Decide deliberately between the 3.0 pre-release line and keeping 2.3.2 away from untrusted input; do not assume “latest stable” is patched.
  • Check DALI 2.3+, Warp 1.16.0+, NVSentinel 1.20.0+. All three are plain version bumps already months old; the only work is confirming what you actually run.
  • Stop treating release notes as marketing. Five of these six projects described their security fixes in prose, weeks before an identifier existed. If your upgrade trigger is a CVE feed, your trigger fires a quarter late. Diff the notes of the AI infrastructure you run, and watch for the vocabulary — “reported to us privately”, “no longer reach loopback”, “now enforce authorization”.
  • Match the artefact, not the label. NVIDIA’s tables use marketing versions (“5.0”, “0.17.1”, “3.0-beta2”) that do not literally match upstream tags (v1.5.0, core_v0.17.1, v3.0.0-beta2). Resolve the mapping before you tell an auditor you are patched.

This is the AI-infrastructure version of a pattern this site has traced through the deepseek-harness silent sandbox rewrite and through NVIDIA’s own DCGM exporter record: the engineering is frequently better than the disclosure. Eighteen records published in one afternoon tell you a vendor’s PSIRT is doing its job on the back end. They also tell you that, for most of this year, the defenders of six widely deployed AI components had no machine-readable reason to upgrade.

Verification note. All 18 CVE identifiers, CVSS 3.1 vectors and base scores, CWE assignments, descriptions, publication timestamps (13 October 2026, 13:17Z) and vulnStatus: Awaiting Analysis were read first-hand from the NVD 2.0 API. All six bulletins — NVIDIA product-security entries 5881, 5889, 5890, 5900, 5901 and 5902 — were read first-hand from the NVIDIA/product-security repository, including their affected/updated version tables, acknowledgements and revision histories; bulletin text is quoted verbatim where quoted. Every upstream tag name and publication timestamp, the commit metadata for 14a0bdde4 and 739fcca2f, and the v1.5.0/v1.5.1 release notes were read first-hand from the GitHub API, and release-note excerpts are quoted verbatim. The InitSpecMsg presence/absence comparison was performed by reading ext/etl/api.go directly at tags v1.4.9, v1.5.0, v1.5.1 and at main. Nothing was installed, no AIStore cluster was deployed, no ETL job was started, no checkpoint was crafted or loaded, and no request was sent to any third-party deployment. The day-count arithmetic, the remediation-gap reading and the ordering of priorities are our editorial analysis. We have no evidence of exploitation and imply none.

Sources: