A CVSS 10.0 in NVIDIA AIStore's PodSpec API: how to check if you are exposed in 15 minutes

NVIDIA AIStore versions through 4.9 are described as vulnerable to CVE-2026-65162, a CVSS 10.0 flaw in its legacy ETL PodSpec initialization API that could allow an unauthenticated remote caller to submit Kubernetes pod settings enabling privileged access, host filesystem mounts, namespace sharing, or service-account changes. The article advises teams to quickly assess exposure by identifying vulnerable AIStore images, checking API reachability, reviewing the AIStore service account’s pod-creation permissions, confirming enforcing admission controls, and searching for suspicious ETL or host-access pods. It recommends upgrading first to AIStore 5.0, then 5.1, which removes the PodSpec initialization path, while immediately reducing risk on unpatched deployments through default-deny NetworkPolicies, targeted admission policies, RBAC cleanup, credential rotation where compromise is suspected, and audit logging. More broadly, it argues that any platform accepting user-supplied PodSpecs can become a privilege-escalation path and that managed Kubernetes services do not remove customers’ responsibility to patch workloads, restrict pod creation, and enforce security controls.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.