CVE-2026-65128

Executive Summary

CVE-2026-65128 is a SQL injection vulnerability (CWE-89) in NVIDIA Infrastructure Controller for Linux. A successful exploit could lead to code execution, data tampering, denial of service, and information disclosure. The vulnerability carries a CVSS base score of 8.8 (High), requires network access with low-privilege authentication, and currently has no confirmed vendor patch, no public proof of concept, and no CISA KEV listing.

Technical Analysis

The affected product is NVIDIA Infrastructure Controller for Linux. According to the NVD description, the vulnerability is a SQL injection (CWE-89) issue that an attacker could leverage to achieve code execution, data tampering, denial of service, and information disclosure. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates that exploitation is network-reachable, requires low attack complexity, demands low privileges (PR:L), requires no user interaction, and has full high impact across confidentiality, integrity, and availability.

SQL injection is a class of vulnerability in which untrusted input is incorporated into a Structured Query Language statement without proper parameterization or sanitization. When application code concatenates user-supplied data directly into a query string, an attacker can alter the query's logical structure. This can enable:

• Authentication bypass by manipulating WHERE clause logic.
• Data exfiltration by injecting UNION or subquery constructs.
• Data modification or deletion through injected INSERT/UPDATE/DELETE statements.
• In some database configurations, code execution via database-native features (e.g., extended stored procedures or xp_cmdshell equivalents) that permit OS command execution.
• Denial of service via destructive queries or resource-exhausting constructs.

The specific injection point, parameter name, endpoint, and database platform are not disclosed in the available NVD description or CNA title. No function names, class names, URL paths, or API parameters are provided in the source data, so this report does not speculate about them. Exploitation mechanics must therefore be described at the vulnerability-class level for this CVE.

The network attack vector and low-privilege authentication requirement imply the vulnerable component is an authenticated service interface reachable over the network. In infrastructure controller products, such interfaces are commonly used for device configuration, telemetry ingestion, and administrative operations, so a SQL injection here could expose both control-plane and data-plane information.

Exploitation Scenarios

Because no public PoC exists and the NVD description is sparse, the following attack chain is inferred strictly from the vulnerability class (SQL injection) and the CVSS vector. No specific function names, endpoints, or parameters are asserted, as none are present in the source data.

1. Reconnaissance/target identification: An attacker with network access identifies an exposed NVIDIA Infrastructure Controller for Linux instance, for example via internet scanning using product or HTTP-banner fingerprints. Low-privilege credentials are obtained (PR:L indicates authenticated access is sufficient), such as through default credentials, credential reuse, or a separate low-impact compromise.

2. Triggering the flaw: The attacker submits crafted input to an application component that builds a SQL query from user-controlled data without parameterization. The injection is delivered over the network through an authenticated request handling path. The attacker manipulates the query logic to bypass intended conditions, UNION-join additional data, or execute stacked or subquery statements depending on backend database support.

3. Payload/execution method: At the vulnerability-class level, the attacker crafts SQL fragments embedded within legitimate input fields to alter query semantics. Depending on backend database features and application error handling, the attacker may use error-based, boolean-blind, time-based, or UNION-based techniques to exfiltrate data. If the backend database supports OS command execution primitives and the application account has sufficient privileges, code execution may be achievable.

4. Post-exploitation impact: Successful exploitation can yield full compromise of confidentiality, integrity, and availability as reflected by the C:H/I:H/A:H subscores. This includes theft of stored data, tampering with or deleting records, denial of service through destructive or expensive queries, and, where database feature abuse is possible, code execution on the underlying host.

No public PoC or exploit code is available; the attack chain above is inferred from the vulnerability class and CVSS metrics only.

Impact Assessment

The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The subscores indicate:

• Attack Vector (N): Exploitable remotely across a network.
• Attack Complexity (L): No special conditions or race windows required.
• Privileges Required (L): Low privileges are sufficient; the attacker does not need administrative access.
• User Interaction (N): No victim interaction needed.
• Scope (U): Impact remains within the vulnerable component's security authority.
• Confidentiality (H), Integrity (H), Availability (H): Total loss of confidentiality, integrity, and availability within the affected component.

Business impact for organizations running NVIDIA Infrastructure Controller for Linux includes potential exposure of sensitive infrastructure data, corruption or destruction of stored records, disruption of controller operations, and possible lateral movement or host-level compromise if code execution is achieved. Blast radius depends on the placement of the controller in the environment and the sensitivity of data it manages. Because no affected version range or patch is published, all deployments of the product should be considered at risk until NVIDIA clarifies the affected versions.

Detection Guidance

Sigma Rule

title: SQL Injection Attempt Against NVIDIA Infrastructure Controller
id: 8f3c2b1a-4d5e-4f6a-9b7c-1e2d3f4a5b6c
status: experimental
description: Detects SQL injection patterns in HTTP requests targeting NVIDIA Infrastructure Controller for Linux, based on CVE-2026-65128 (CWE-89).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65128
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
      - PUT
  selection_sqli:
    - cs-uri-query|contains:
        - "' OR "
        - "' AND "
        - "UNION SELECT"
        - "UNION ALL SELECT"
        - "'; --"
        - "1=1"
        - "1=0"
        - "SLEEP("
        - "BENCHMARK("
        - "WAITFOR DELAY"
        - "xp_cmdshell"
        - "information_schema"
        - "OR 1=1"
  condition: selection_method and selection_sqli
falsepositives:
  - Legitimate application input containing SQL keywords
  - Security scanners and vulnerability assessment tools
level: high
tags:
  - attack.t1190
  - cve.2026.65128

YARA Rule

rule CVE_2026_65128_SQLInjection_NVIDIA_Controller
{
    meta:
        description = "Detects SQL injection payload patterns associated with CVE-2026-65128 in NVIDIA Infrastructure Controller for Linux"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65128"
        cve = "CVE-2026-65128"
        severity = "high"

    strings:
        $sqli1 = "' OR " nocase ascii
        $sqli2 = "' AND " nocase ascii
        $sqli3 = "UNION SELECT" nocase ascii
        $sqli4 = "UNION ALL SELECT" nocase ascii
        $sqli5 = "'; --" ascii
        $sqli6 = "OR 1=1" nocase ascii
        $sqli7 = "SLEEP(" nocase ascii
        $sqli8 = "BENCHMARK(" nocase ascii
        $sqli9 = "WAITFOR DELAY" nocase ascii
        $sqli10 = "information_schema" nocase ascii
        $sqli11 = "xp_cmdshell" nocase ascii

    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65128 SQL Injection Attempt Against NVIDIA Infrastructure Controller"; flow:established,to_server; http.method; content:"GET" or content:"POST"; http.uri; pcre:"/(\%27|\')(\s)*(OR|AND)(\s)+(\%31|\d)+(\%3D|=)(\%31|\d)/Ui"; pcre:"/UNION(\s)+(ALL(\s)+)?SELECT/Ui"; pcre:"/(SLEEP|BENCHMARK|WAITFOR(\s)+DELAY)(\s)*\(/Ui"; reference:cve,2026-65128; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65128; classtype:web-application-attack; sid:202665128; rev:1;)

Elastic Detection

sequence by host.name, source.ip with maxspan=5m
  [network where network.protocol == "http" and http.request.method in ("GET", "POST", "PUT") and
   wildcard(http.request.body*, ("*' OR *", "*' AND *", "*UNION SELECT*", "*OR 1=1*", "*'; --*"))]
  [network where network.protocol == "http" and
   wildcard(http.request.body*, ("*SLEEP(*", "*BENCHMARK(*", "*WAITFOR DELAY*", "*information_schema*", "*xp_cmdshell*"))]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval uri_body = coalesce(uri, url, cs_uri_stem, "") . " " . coalesce(form_data, cs_uri_query, "")
| where match(uri_body, "(?i)('|\%27)\s*(OR|AND)\s+\d+\s*(=|\%3D)\s*\d+") OR match(uri_body, "(?i)UNION\s+(ALL\s+)?SELECT") OR match(uri_body, "(?i)(SLEEP|BENCHMARK|WAITFOR\s+DELAY)\s*\(") OR match(uri_body, "(?i)(information_schema|xp_cmdshell)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, uri, status
| sort - count

Wazuh OSSEC Rule

<group name="web,sql_injection,nvidia,">
  <rule id="2026651" level="12">
    <if_sid>31100,31101,31103,31104,31106,31108</if_sid>
    <id>^CVE-2026-65128$</id>
    <description>CVE-2026-65128: SQL injection attempt detected against NVIDIA Infrastructure Controller for Linux</description>
    <options>no_full_log</options>
    <group>sql_injection,web_attack,</group>
  </rule>

  <rule id="2026652" level="12">
    <if_sid>31100,31101,31103,31104,31106,31108</if_sid>
    <url>(?i)(union(\s+all)?\s+select|or\s+1=1|'\s*or\s*'|sleep\s*\(|benchmark\s*\(|waitfor\s+delay|information_schema|xp_cmdshell)</url>
    <description>CVE-2026-65128: SQL injection payload signature detected in HTTP request URL</description>
    <group>sql_injection,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is currently published for CVE-2026-65128.

1. Immediate mitigations:

• Restrict network access to NVIDIA Infrastructure Controller administrative and API interfaces using firewall rules, network segmentation, and allowlisting of management subnets.
• Enforce strong, unique authentication and remove or disable unused low-privilege accounts, since exploitation requires only low privileges (PR:L).
• Deploy the detection rules above (Sigma, YARA, Suricata, Elastic, Splunk, Wazuh) to monitor for SQL injection payloads and anomalous query behavior.
• Enable database logging and application error logging to capture injection attempts and unexpected query failures, and feed them into the SIEM.
• Where possible, enable a web application firewall (WAF) in blocking mode with SQL injection signatures to provide virtual patching.

2. Patch/upgrade steps:

• Monitor NVIDIA's official security bulletin and product advisory channels for a fix. At the time of writing, no patch reference or fixed version is available.
• Subscribe to NVIDIA security notifications and the NVD entry for CVE-2026-65128 to receive updates when a patch is released.
• Once a patched version is published, stage and validate it in a non-production environment before production rollout.

3. Long-term hardening:

• Adopt parameterized queries and prepared statements in all database access paths as a development standard to eliminate the SQL injection class.
• Apply least-privilege database accounts for application services to limit the impact of any injection that succeeds.
• Implement secure code review and static/dynamic application security testing (SAST/DAST) into the SDLC.
• Maintain asset inventory for infrastructure controllers and include them in regular vulnerability scanning and patch management cycles.
• Disable or sandbox database features that permit OS command execution, such as xp_cmdshell, where they are not operationally required.

References

• NVD — CVE-2026-65128: https://nvd.nist.gov/vuln/detail/CVE-2026-65128
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• NVIDIA Product Security Incident Response Team (PSIRT) advisories: https://www.nvidia.com/en-us/security/
• FIRST EPSS (no score currently assigned for this CVE): https://www.first.org/epss/

No public proof-of-concept, exploit code, Nuclei template, or CISA KEV listing is available for CVE-2026-65128 at the time of writing. No threat actor campaigns or exploit-in-the-wild evidence have been associated with this CVE in the provided data.