CVE-2026-65113

Executive Summary

CVE-2026-65113 is a critical use of hard-coded credentials vulnerability in the NVIDIA Infrastructure Controller for Linux, rated 9.8 CVSS with a network-accessible, unauthenticated attack vector. The flaw (CWE-798) allows an attacker who obtains or guesses embedded static credentials to escalate privileges, tamper with data, cause denial of service, and disclose information. Any Linux deployment of the NVIDIA Infrastructure Controller is potentially exposed, but no patch, affected version list, or public exploit currently exists, leaving defenders dependent on network-layer controls and credential hygiene.

Technical Analysis

The NVD description states that the NVIDIA Infrastructure Controller for Linux "contains a vulnerability where an attacker could cause use of hard-coded credentials." This is a CWE-798 (Use of Hard-coded Credentials) weakness: credentials — such as passwords, cryptographic keys, or API tokens — are embedded directly in the shipped software rather than generated at install time, derived from a secure secret store, or supplied by the operator. Because the value is static and shared across every instance of the affected product, it is not unique per deployment, cannot be rotated by normal configuration, and once discovered (through firmware extraction, binary reverse engineering, source leaks, or simple scanning) grants access to every vulnerable deployment.

The attack surface is remote and network-facing per the CVSS vector (AV:N), with low attack complexity (AC:L) and no required privileges (PR:N) or user interaction (UI:N). The vulnerability is scored as scope-unchanged (S:U) but with high confidentiality, integrity, and availability impact (C:H/I:H/A:H). This profile is consistent with an attacker reaching a management interface, service, or inter-component channel of the Infrastructure Controller and authenticating with the embedded credential, then operating with whatever privileges that credential confers.

The publicly available data does not disclose:

• The specific hard-coded credential type (password, API key, certificate, private key, or token).
• The exact component, port, or interface on which the credential is accepted.
• Whether the credential is exploitable pre-authentication for initial access or only to pivot between internal services.
• The affected NVIDIA Infrastructure Controller for Linux version range.

Analysts should therefore reason at the vulnerability-class level. No function names, file paths, endpoints, or parameter names are stated in the authoritative description, and none should be inferred. Additional detail must come from NVIDIA's eventual security bulletin once published.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available; the attack chain below is inferred from the CWE-798 vulnerability class and the CVSS vector. It describes attacker behavior in class terms only and does not assert specific implementation details.

1. Reconnaissance / target identification. The attacker identifies internet- or intranet-reachable instances of the NVIDIA Infrastructure Controller for Linux. This may be done via Shodan/Censys queries for exposed management interfaces, TLS certificate subject names, HTTP banners, or known default ports. Scanning is unauthenticated and does not require prior access.

2. Triggering the flaw class. Unlike memory-corruption bugs, CWE-798 is triggered simply by presenting the static credential that the product ships with. The attacker supplies the hard-coded value (learned from extracted firmware, de-compiled binaries, leaked source, vendor documentation, or credential-guessing against well-known defaults) to the authentication mechanism that consumes it. Because AC:L and PR:N, no vulnerability-specific exploit primitive is needed — only knowledge of the static secret and network reachability.

3. Access establishment. On acceptance of the hard-coded credential, the attacker obtains whatever session or privilege context that secret authorizes. If the credential belongs to a privileged service account or administrative interface, the attacker lands with elevated rights relative to a normal unauthenticated user. UI:N indicates no victim has to click anything for this to succeed.

4. Post-exploitation impact. Per the CVSS impact vector, a successful exploit can yield privilege escalation, data tampering, denial of service, and information disclosure. In practice this could mean reading configuration or telemetry data (C:H), modifying controller settings or managed workloads (I:H), and disrupting or halting control functions (A:H). Because the credential is hard-coded, re-using it across a fleet can enable lateral movement between Infrastructure Controller instances and enables persistence even after incident response, unless the secret is rotated or the software replaced.

Defenders must treat this as an unauthenticated, network-facing weakness. Until NVIDIA publishes details, the precise access path (which listener or interface) is unknown, and monitoring should focus on the generic signals below rather than product-specific artifacts.

Impact Assessment

The CVSS base score of 9.8 reflects the maximum impact class in a single-scope, network-reachable, no-preconditions context. The sub-scores are:

• AV:N — exploitable across a network, widening the set of reachable targets beyond local or adjacent attackers.
• AC:L — no specialized timing, race, or memory-manipulation technique; reliability is high.
• PR:N — no credentials beyond the hard-coded one need be obtained, so the usual authentication barrier is bypassed.
• UI:N — no operator action is required, enabling automated, large-scale attempts.
• S:U — impact is contained within the vulnerable component's security authority.
• C:H / I:H / A:H — full loss of confidentiality, integrity, and availability of the affected component.

Business impact centers on the role of an Infrastructure Controller: it manages and orchestrates NVIDIA infrastructure, so compromise can affect the systems it controls, not just the controller itself. Affected organizations are those running the NVIDIA Infrastructure Controller for Linux. The blast radius scales with how widely the product is deployed and how many instances share the same hard-coded credential — a single leaked secret can threaten the entire fleet. Denial of service against a controller can cascade into outages of the managed infrastructure, elevating availability impact beyond the immediate device. Data tampering undermines trust in telemetry and control decisions, and information disclosure may expose configuration, topology, or secrets in the controller.

No EPSS score exists yet, no CISA KEV listing exists, and there is no evidence of in-the-wild exploitation. The practical risk is currently governed by exposure: if instances are not internet-reachable and credentials are tightly controlled, near-term exploitation likelihood is lower; internet-exposed controllers should be treated as high priority regardless.

Detection Guidance

Sigma Rule

title: Potential Exploitation of NVIDIA Infrastructure Controller Hard-Coded Credentials (CVE-2026-65113)
id: 7b2f5c1a-9d4e-4c88-b0a1-3f6e2a9c1d77
status: experimental
description: Detects authentication or access patterns consistent with use of hard-coded credentials against NVIDIA Infrastructure Controller for Linux services.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65113
author: valtersit.com
date: 2026/01/01
logsource:
  category: authentication
  product: linux
detection:
  selection_service:
    process_name|contains:
      - 'nvidia'
      - 'infra'
      - 'controller'
  selection_outcome:
    - message|contains: 'authentication success'
    - message|contains: 'Accepted'
    - message|contains: 'session opened'
  selection_anomaly:
    - src_ip|cidr:
        - '0.0.0.0/0'
    - user|contains: 'service'
    - user|contains: 'admin'
  condition: selection_service and selection_outcome and selection_anomaly
falsepositives:
  - Legitimate service-to-service authentication using intended accounts
level: high
tags:
  - attack.t1078
  - cve.2026-65113

YARA Rule

rule CVE_2026_65113_Hardcoded_Creds_NVIDIA_Controller
{
    meta:
        description = "Detects potential hard-coded credential patterns in NVIDIA Infrastructure Controller for Linux artifacts (CVE-2026-65113)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65113"
        cve = "CVE-2026-65113"
        severity = "critical"

    strings:
        $c1 = "hardcoded" ascii nocase
        $c2 = "hard-coded" ascii nocase
        $c3 = "default_password" ascii
        $c4 = "defaultpassword" ascii nocase
        $c5 = "DEFAULT_KEY" ascii
        $c6 = "shared_secret" ascii nocase
        $c7 = "NVIDIA" ascii

    condition:
        $c7 and 2 of ($c1, $c2, $c3, $c4, $c5, $c6)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-65113 Possible NVIDIA Infrastructure Controller Hard-Coded Credential Use"; flow:established,to_server; content:"NVIDIA"; http_header; nocase; content:"Authorization"; http_header; nocase; threshold: type both, track by_src, count 10, seconds 60; reference:cve,2026-65113; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65113; classtype:attempted-admin; sid:202665113; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [authentication where event.outcome == "success" and process.name : "nvidia*"]
  [network where destination.port != null and process.name : "*controller*"]

Splunk SPL Query

index=linux OR index=network
| search ("nvidia" OR "infrastructure controller" OR "infra-controller")
| stats count, values(src) as sources, values(user) as accounts by host, dest_port, action
| where action="success" AND count >= 5
| sort - count

Wazuh OSSEC Rule

<group name="nvidia,cve-2026-65113,">
  <rule id="100513" level="12">
    <if_sid>5716</if_sid>
    <match>nvidia</match>
    <description>CVE-2026-65113: Successful authentication to NVIDIA Infrastructure Controller - possible hard-coded credential use</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_success,pci_dss_10.2.5,</group>
  </rule>

  <rule id="100514" level="10">
    <if_sid>5710</if_sid>
    <match>controller</match>
    <description>CVE-2026-65113: Multiple failed authentication attempts against controller service</description>
    <group>authentication_failed,pci_dss_10.2.4,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is currently published. The guidance below is class-level and interim.

1) Immediate mitigations

• Remove internet exposure of any NVIDIA Infrastructure Controller for Linux management or service interfaces; place them behind a VPN, zero-trust proxy, or management VLAN.
• Restrict reachability with host and network firewalls to only the specific trusted administrators or services that need access; default-deny all other sources.
• Where the credential is operator-configurable, rotate any embedded/default secrets and replace them with unique, strong, per-deployment values stored in a secrets manager rather than in configuration files or images.
• Search for and eliminate shared static secrets across the controller fleet; assume any single-instance secret may already be known to an adversary.
• Increase logging and alerting on authentication events to the controller and monitor the detections described above.

2) Patch / upgrade steps

• Monitor NVIDIA's security bulletin page and the NVD entry for CVE-2026-65113 for an official advisory that identifies affected versions and a fixed release.
• Once a fixed version is published, inventory all deployments, test the upgrade in a non-production environment, then upgrade promptly.
• Immediately after patching, rotate all credentials associated with the controller, since hard-coded secrets must be considered compromised by design.
• If upgrade is not immediately possible, continue interim mitigations and re-assess exposure continuously.

3) Long-term hardening

• Enforce a secrets-management policy that prohibits embedded credentials and requires per-instance, rotatable secrets for all infrastructure components.
• Integrate static-analysis and binary-scanning checks into procurement and CI pipelines to catch CWE-798 patterns before deployment.
• Apply least-privilege service accounts and network segmentation so that a single compromised credential cannot move laterally across the fleet.
• Maintain an asset inventory with version tracking so newly disclosed affected ranges can be matched to deployed instances rapidly.

References

• NVD — CVE-2026-65113: https://nvd.nist.gov/vuln/detail/CVE-2026-65113
• CWE-798 — Use of Hard-coded Credentials: https://cwe.mitre.org/data/definitions/798.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• NVIDIA Product Security (vendor advisory pending): https://www.nvidia.com/en-us/security/
• CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public exploit, PoC, Nuclei template, threat actor campaign, or exploit-in-the-wild evidence is currently associated with CVE-2026-65113. EPSS is not yet scored by FIRST.org, and the CVE is not listed in CISA KEV.