CVE-2026-24218

HIGH EPSS 43.6%
Published May 20, 20261mo ago · Modified Jun 17, 20261w ago
8.1 CVSS 3.1
High
Find Similar
Published May 20, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed across multiple systems. The sharing of cryptographic identifiers across all similarly provisioned systems enables host impersonation or attacker-in-the-middle attacks. A successful exploit of this vulnerability might lead to code execution, data tampering, escalation of privileges, information disclosure, and denial of service.

CVSS Details

Base Score
8.1
Exploitability
2.2
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
43.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-321

Affected Products 2

VendorProductVersionRange
nvidiadgx_os*any
nvidiadgx_spark*any

References 3

  • nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2026-24218
    US Government Resource
  • nvidia.custhelp.com https://nvidia.custhelp.com/app/answers/detail/a_id/5835
    Vendor Advisory
  • cve.org https://www.cve.org/CVERecord?id=CVE-2026-24218
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.