NVIDIA patches CVSS 9.8 hard-coded credential flaw in all versions of its AI data center controller

NVIDIA's Infrastructure Controller for Linux — the control plane that automates bare-metal provisioning for AI clusters — shipped with hard-coded credentials in every version released to date. According to a Netics analysis published on dev.to, the vulnerability is tracked as CVE-2026-65113, carries a 9.8 rating on the CVSS v3.1 scale, was disclosed on September 22, 2026, and affects versions 0 through 1.9 of the component, which NVIDIA calls NICo.

The vulnerability

The bug falls under CWE-798, the use of hard-coded credentials. Netics reports that the static credentials let an unauthenticated remote attacker bypass authentication entirely, and that NVIDIA's advisory describes the consequences of a successful exploit as potential privilege escalation, data tampering, denial of service, and information disclosure. There was no confirmed in-the-wild exploitation at the time of disclosure, and the exploit-prediction score attached to the CVE was low. The fix is version 2.0 of the controller, taken from the project's official repository — which, per the report, was moved out of NVIDIA's GitHub organization on September 4, 2026.

What NICo actually controls

The rating matters less than what the software is permitted to do. NICo is a Kubernetes-based control plane with a REST API, site agents, and Temporal workflows, deployed on the bare-metal cluster it manages. Its responsibilities include hardware discovery, firmware validation, DPU provisioning through the DOCA Platform Framework, OS deployment, network isolation, and tenant sanitization, at rack scale on systems including NVIDIA's GB200 and GB300. In practice it is the layer that prepares raw hardware to join a multi-tenant AI cloud, which means a compromised controller can reach every tenant's machines, every DPU, and the very network isolation it is supposed to enforce.

Thirteen more CVEs in the same batch

The hard-coded credentials headline a fourteen-CVE advisory batch (bulletin 5879): one critical, five high, and eight medium. The high-severity entries include a SQL injection rated 8.8 (CVE-2026-65128) that Netics says low-privilege attackers could turn into code execution, missing authentication on a critical function at 8.3 (CVE-2026-65114), improper authentication enabling privilege escalation at 8.2 (CVE-2026-65121), and OS command injection at 8.0 (CVE-2026-65130). The medium tier spans improper certificate validation, external file and path control, XML injection, workflow-enforcement failures, a second hard-coded password, uncontrolled resource consumption, and leftover debug information.

Netics reads the batch as one pattern: a management plane that accumulated authentication and trust-validation weaknesses across its release history, only surfacing when the code was reviewed as a whole. The report also notes that NVIDIA's reference deployment for NICo includes Vault and external-secrets, which makes a credential embedded in the controller itself all the more conspicuous.

What operators should do

Upgrading to NICo 2.0 is the mechanical fix, but Netics frames it as a precondition rather than the full answer. The follow-up is to treat the management network as the most sensitive segment in the environment: reachable only via a dedicated management VLAN or a jump-host path, never from tenant networks or the internet. Because the DPUs NICo provisions cannot be controlled from tenant host operating systems, the controller is the single point on which the hardware-level isolation story depends. Netics also recommends auditing the controller's configuration for other hard-coded or default credentials and rotating anything inherited — and, for the multi-tenant AI-cloud and GPU-as-a-service operators the advisory targets, documenting management-plane isolation as part of the change process rather than relying on the upgrade alone.

Why it matters

As AI infrastructure consolidates into GPU clouds and large on-prem clusters, the management plane is where the trust boundary now sits — and this advisory suggests its security has not kept pace with its privileges. A hard-coded credential in an ordinary web application is contained; the same flaw in the component that provisions every server, DPU, and tenant network in an AI data center hands an attacker the foundation the isolation model rests on. Operators bringing new GPU capacity online should use this as a prompt to inventory what their controllers can reach, and who can reach the controllers.